Hacker News Reader

Comment by tantalor | Hacker News Reader

That's a good thing?

Most consumer websites won't use attestation.

Places where additional security is required (bank, employer, etc) can.

Most consumer websites won't demand you share a scan of your face to third parties, until they do. Same exact thing will happen with passkeys, guaranteed.

Exactly how http was the standard for normal websites and banks et. al. using https until, everyone was.

Now that was a good thing with https, not so much with passkeys until Chrome pushes through a change and says they'll only accept attested passkeys issued by their own google password manager/authenticator.

Adding HTTPS everywhere was not "a good thing", it's coping with a civilizational coordination failure that shifted us to a lower trust equilibrium. We're paying the price for that in an endless update treadmill for clients and even for read-only webservers. And more compute-cycles and latency spent on the encryption handshake. We also lost caching HTTP proxies. This is bad actors creating a negative-sum outcome.

Not encrypting by default is a ludicrously unstable position as far as trust 'equilibrium' goes. It would be an astounding feat of coordination to avoid needing it as the internet grow, probably one that would cost far more than https.

Conversely, exploiting the the lack of encryption would also be an unstable position because the world then shifts to encryption, voiding your access. So you're trading a one-time benefit to yourself against permanent ongoing costs for the whole world.

I know that humans are poorly equipped to solve these kinds problems, but it still is lamentable.

Access is a good thing too. I don’t want hardware attestation, i want to be able to access my bank from anywhere. Banks continually push their liability for security onto customers.

> Banks continually push their liability for security onto customers.

Bank customers: "You don't need to know anything about me."

Also bank customers: "You need to stop anyone who is not me from accessing my money."

People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.

I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here

Well those people can buy a YubiKey for $30 I guess. I don't see why that's a big issue.

The line of thinking, I guess, is that you shouldn't be forced to buy a specific companies device just to access your own money. And in 10 years time, the companies approved to make devices like this will be DisneyAppleFlix and TeslOpenAI.

That's my guess, at least. I know next to nothing about attestation and passkeys.

Why do you think YubiKey would be an allowed option? Sites will require Google/Apple password manager and use this as a proxy to prevent bot accounts.

Reply on news.ycombinator.com