I cannot possibly game out all future adverse design choices that a vendor may make. Today, October 14th 2026, Passkeys offer more upsides to me than they do downsides, so I use them
If a particular app vendor or website changes how they accept or use Passkeys, then I won't use them for that app or site. If my computing platform vendor(s) make it harder or worse to use Passkeys then I'll bail out
There's a lot of what-ifs in every decision, and I cannot possibly nor would I want to, figure out 82 steps ahead in 4-D chess how company X may try to screw me over
You don't have to do game out all solutions, no one can. We game them out as a group and share our perspectives, as we are here today, and then take more time to reflect on what others have said, eventually returning to iterate with refined understandings, and we will each make our own more informed choices, not always the same.
This blog post is the perfect example of someone rationalizing away the bigger picture.
It's true that passkeys do not require hardware and OS attestation today, so all of the specific examples you cite are true. But the point remains that that passkeys can be EASILY extended to require hardware and OS attestation, and this will happen.
Banks have already done this. Before using an app was optional. Play protect was optional. It's like my uncle ted used to say, techonolgy is not optional.
When my state introduced seatbelt laws they assured the public that they would only be a secondary offense, never the primary basis for getting pulled over and issued a ticket.
Now they run "Officers are watching! Click it or ticket!" as an advertising campaign.
And I'm not arguing that seatbelt laws are bad per se, just that any time there is a pathway for more control, it will eventually be taken, even if assurances are made that it will not happen.
When you’re dealing with people so persistently stupid that they haven’t figured out the value of seatbelts, while still generally insisting that the costs of their medical care are socialized, my appreciation for the necessity of social control is enhanced rather than dampened.
When it comes to attestation, it's purely promoting business and state interests against yours. No security comes with it, it's purely control.
Imagine being the owner of a small business who is now required, to do business with any providers, to have a rogue executive that is loyal to them rather than you, and overrides your decisions; your provider refuses to sell you any materials if this executive is not obeyed. Do you think any business owner would accept that? I think on the contrary, this practice would be outlawed by Congress or the relevant legislative body in a matter of weeks. Those who voted seatbelts in.
Then it's exactly that, if you replace business by computer.
You’re telling a story and the story is consistent, but it’s still a story. Besides you’re making a lot of assumptions about me, my beliefs, and what might be of concrete benefit to me.
I think it's more that attestation can require a specific "approved" authenticator, and that authenticator is what would enforce all of the required OS/Software/Hardware requirements, even if it didn't get included in the attestation standard.
How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.
Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.
It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.
and your bank can't force a certain client for a password if they decide to? or that you need to drink a confirmation can? or whatever arbitrary technical constraints they want to do in general?
anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.
They effectively can't to the extent that it's not a social norm to enforce that level of security theater. You are arguing in favor of normalizing an increased degree of security theater.
My point here is that this specific step on the slippery slope is a cliff, not some infintessimal change, because now the authentication is done through a program and not copyable information. If verification-can technology is standardized on an OS level and advocated by four out of five tech priests (and maybe even enshrined in law (think of the children)), then you are going to be drinking a whole lot more mountain dew in the future to say the least.
If it was just a single bank or something that tried this, people would get pissed off, leave, and the frog would not be boiled. It takes a slow industry-wide movement to shift the standards of what is acceptible to the common man.
Most consumer websites won't demand you share a scan of your face to third parties, until they do. Same exact thing will happen with passkeys, guaranteed.
Exactly how http was the standard for normal websites and banks et. al. using https until, everyone was.
Now that was a good thing with https, not so much with passkeys until Chrome pushes through a change and says they'll only accept attested passkeys issued by their own google password manager/authenticator.
Adding HTTPS everywhere was not "a good thing", it's coping with a civilizational coordination failure that shifted us to a lower trust equilibrium. We're paying the price for that in an endless update treadmill for clients and even for read-only webservers. And more compute-cycles and latency spent on the encryption handshake. We also lost caching HTTP proxies.
This is bad actors creating a negative-sum outcome.
Not encrypting by default is a ludicrously unstable position as far as trust 'equilibrium' goes. It would be an astounding feat of coordination to avoid needing it as the internet grow, probably one that would cost far more than https.
Conversely, exploiting the the lack of encryption would also be an unstable position because the world then shifts to encryption, voiding your access. So you're trading a one-time benefit to yourself against permanent ongoing costs for the whole world.
I know that humans are poorly equipped to solve these kinds problems, but it still is lamentable.
Access is a good thing too. I don’t want hardware attestation, i want to be able to access my bank from anywhere. Banks continually push their liability for security onto customers.
People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.
I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here
The line of thinking, I guess, is that you shouldn't be forced to buy a specific companies device just to access your own money. And in 10 years time, the companies approved to make devices like this will be DisneyAppleFlix and TeslOpenAI.
That's my guess, at least. I know next to nothing about attestation and passkeys.
Nuclear fuel can also be recycled. The point is, a solar panel produces a finite amount of energy over its lifetime, so it's not exactly comparable to a power plant in terms of energy independence.
It's not appropriate to think of the solar panel as a constant source of power, but the solar panel manufacturing plant. All of our nuclear reactors and fuel are produced in-country, whereas china has dominated solar panel manufacturing and can cut us off. We need to be proactive about manufacturing.
Nuclear fuel cannot be recycled. Nuclear fuel is consumed during use, that's why it's fuel.
A spent solar panel contains the exact materials needed to make a new solar panel. Chemical changes are cheaply reversible, so you can turn an old solar panel into a new one for less energy than it will produce during it's lifetime. A solar panel factory can operate indefinitely. (Or at least for as long as their is solar energy available.)
Nuclear fuel must be mined. Nuclear changes are reversible, but that requires the same amount of energy you would get back out. The Earth has a finite amount of nuclear fuel. (To be fair, there's a lot. The Earth contains enough fuel to last roughly the lifespan of the Sun.)
Nothing lasts forever. Even nuclear plants have to eventually be decommissioned. Solar panels may be finite, but they give you a long, predictable horizon.
China might be subsidizing solar panels today. We should load up while we can. Let them bear the initial costs. We should also spin up more domestic manufacturing (which was a component of the IRA). If/when foreign sourced solar panels are no longer available, you are in the exact same position you were the day before. All of that already installed generation capacity will continue to function for years before a crisis emerges.
reply