this post was submitted on 14 Oct 2026
129 points (74.7% liked)
Privacy
51450 readers
371 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Why would I want a convenient passkey stored securely inside my password manager if I can just, much more conventiently, lock myself out of my account by losing my phone?
Don't put it in your phone?
The point is that attestation allows for services to restrict where do you put it on.
The attestation certificate includes metadata securely identifying the exact maker, model, and capabilities of the local authenticator you used, with the purpose of allowing services to verify if they trust the authenticator.
So if you use your own no-name open source fork of a particular authenticator and don't even register it with the FIDO Alliance Metadata Service then services requiring attestation would reject your keys. Unless they explicitly make the exception for your particular AAGUID (at which point.. why ask for attestation in the first place?)
The issue is not with passkeys themselves, but the attestation feature specifically, which is part of the standard.
would be nice, but apparently i do not exist according to my bank without a phone on my person 24/7