this post was submitted on 14 Oct 2026
128 points (74.4% liked)
Privacy
51489 readers
293 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
no, fuck passkeys. they will lock everyone in with their proprietary bullshit.
use a good generated password in a manager if you will. don't trust anything corps are pushing.
What propietary bs? It's an open standard.
the www is also an open standard, and google controls it through chrome.
that's quite a leap.
Yes google does have a lot of control over the HTML and HTTP specs because they control the most popular web browser. Whether people are or will in the future be "locked in" to google for that reason is debatable.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification.
yes it is
So we shouldn't have created HTTP because Google might appear?
we should have learned our lesson after they did and done our damndest to create protocols immune to capture. there were excuses in 1989, there aren’t now
How do you create protocols immune to capture?
A good start would be to not bundle into the protocol a method explicitly intended for services to be able to securely identify what local software (or hardware) you used with the explicit purpose of allowing the service to be able to reject access if that client software (or hardware) is not allowlisted.
Passkeys is a great idea. But the "Attestation" part of the protocol ...not so much.
Is this with the intention of excluding bots?
This has nothing to do with what we're talking about.
It may make it somewhat harder, but I wouldn't say it makes bots impossible (eg. device farms).
But I agree botting has nothing to do with what we are talking about.
We are talking about "capturing" the user and I'm saying the protocol has built-in a method for services to require the users to use only the authentication methods the service allows.
The attestation certificate includes metadata securely identifying the exact maker, model, and capabilities of the local authenticator you used, with the purpose of allowing services to verify if they trust the authenticator.
So if you use your own no-name open source fork of a particular authenticator and don’t even register it with the FIDO Alliance Metadata Service then services requiring attestation would reject your keys (unless they explicitly make the exception for your particular AAGUID... but at that point why ask for attestation in the first place?).
You have a very strange way of communicating but I see your point.
Imagine if HTTP explicitly documented as part of the standard that the "User-Agent" header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don't like that your browser is too old...
Considering how much abuse there has been with the User-Agent header... I can't imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
I don't see your point I'm sorry. This would make it easier for Google to exclude small competitors.
The point is that not all protocols are created equal. So "we shouldn’t have created HTTP" depends on what HTTP is specifying.
If a protocol makes it easier for big players to abuse the system, then it's a worse protocol in that respect.
The point being made against passkeys is that, in some respects, it's worse because of the inclusion of attestation as part of the standard.
Is this the new "killing baby Hitler"?
Honestly not sure what's going on in this thread.
Don't invent the internet because then you will have internet companies.
google will also control the most popular passkey manager. is that not obvious by how they already control the most popular password manager, browser, search engine and more?
I'm really struggling to follow your logic here. You're saying they already have the most popular password manager so we shouldn't support a next gen, more secure, open standard because Google will have the most popular client for that also?
The obvious problem with this reasoning is that... there will be alternatives of you don't wish to use googles implementation.
unless google finds a way to lock you in (or out), like they've done pretty much everywhere else. me and you using foss won't change what's coming for society at large.
i mean how can you not see how they have been hoovering up everything on the internet for the last couple of decades and think they won't find a way to to capture this too and run it their way, like all before it?
I do see Google's behavior and I'm certain that they will do their best to capture this as they have everything else.
However, it's an absurdity to suggest that we should not develop new protocols because google will act to ensure they have the largest market share.
there's the thing though: "we" are not developing it. "they" are.
What are you talking about? I'm locked in with all my passkeys that are stored in my open source self hosted password manager that syncs across all my devices?
Like, I'm confused on what you mean
people self-hosting their open-source password managers are in the vast minority. most people will use whatever is pushed to them, which is gonna be vendor lock-in.
Sure but that's not an inherent issue with passkeys.
You can use whatever proprietary password manager you'd like. Sure that often means people are using the device built in ones...
But why should that stop me personally from using passkeys?
it is. passkeys are not memorable.
and if all you are thinking about is how you should personally set up your own computer, you are missing the forest for the trees. we will keep happening upon android type situations if we're being that individualist.