> And the passkey provider can enforce the lack of attestation by refusing to support it.

Then you won't be able to use it with Netflix when they require attestation. How's that supposed to help?

> nothing in principle stops them from forcing you to use [...] Microsoft Authenticator

Did you read the article? The author explicitly compares passkeys with TOTP, and explains how relying parties cannot force you to use a specific TOTP provider, because TOTP providers are indistinguishable from the relying party perspective. You could do it with pen and paper and nobody could stop you.

> Yet I do not see people using that as a reason to write articles about how OIDC 2.0 [...] is a trap.

First, there's no such thing as OIDC "2.0". And yes, people do complain about the SSO "Log in with X" services, for precisely the same lock in problems:

https://jeangalea.com/hidden-cost-of-sign-in-with-google/

https://www.androidauthority.com/are-you-still-using-sign-in...

https://www.techlusive.in/features/i-used-sign-in-with-googl...

Sorry to be blunt, but if your account was not so old I would be reporting you as a possible bot or troll. In my 16 years on HN, this has been my most baffling conversation. I see your other comments on this same post, and you make good points there, I don't understand what's going wrong here.