Skip to main content


There was a lot of news the other day about passkeys and portability - fidoalliance.org/fido-alliance… - that says in part:

"Until now, there has been no standard for the secure movement of credentials, and often the movement of passwords or other credentials has been done in the clear."

This is true, but... there is also still no standard for any of that. The specs are mostly empty placeholders.

fidoalliance.org/specs/cx/cxp-…

fidoalliance.org/specs/cx/cxf-…

Solid Mitch Hedberg energy here.

This entry was edited (1 month ago)

reshared this

in reply to mhoye

And, Christ On A Bike, going to press to announce the important developments in your shiny new security protocol, with "Security Considerations: TODO Security" _right there in the text of the spec_ does not fill me with confidence that you are taking this seriously.
This entry was edited (1 month ago)

reshared this

in reply to Kevin Boyd

Decades ago, @shaver said, "when you say 'it's mostly working', I hear 'we have basically nothing, but you have no way to check that.'", and I think about that probably once a month.
This entry was edited (1 month ago)
in reply to mhoye

This is the most important thing you need to know about passkeys: that "Authorizing Party" box in the spec?

That's not you. They're not actually "your" passkeys.

reshared this

in reply to mhoye

Thank you @mhoye
Those passkeys have felt off from the start.
I'll keep my unique complex passwords that I alone control for the time being.
in reply to mhoye

wow sounds great. I am very eager to just outsource control of my entire functional existence
in reply to mhoye

That's a weird point of view when you think about where you are going to log in. 🤷

Almost never a good idea but I'll try a comparison with the physical world: on the key for my house it reads WINK HAUS but it's still my house and my key.

This entry was edited (1 month ago)
in reply to Karl Voit

of you need to move your house key from one keychain to another, or make a copy for yourself, you don’t need your lock’s manufacturer’s consent to do that, or their participation mediating that exercise, and they can’t arbitrarily refuse to allow it.

But all of that is exactly how passkeys work.

This entry was edited (1 month ago)
in reply to mhoye

@publicvoit but it’s also not your house/computer. It’s someone else’s house/computer. You just happen to leave your stuff (data) inside there.

So they already control your access, regardless of who controls the keys.

What is being said about passkeys is still true. Just unsure of the significance within this reality.

in reply to mhoye

What dimwit passed up the opportunity for Authorizing Authority?
in reply to mhoye

the last I saw github.com/keepassxreboot/keep… was that tests and certification were "being worked out" and I'm still left feeling like this entire endeavor is an attempt to DRM passwords?

being locked out of accounts because my password manager is "no longer blessed" sure feels like a bad idea.

in reply to rj

@arrjay My impression of passkeys has been, from the beginning, "What if SSH keys were something a third party megacorp could monitor and revoke", and I haven't seen a compelling reason to revisit that yet.
@rj
in reply to mhoye

@mhoye but spooky @rj Honestly, a huge portion of them seem to be "brute force attacks are hard and complicated, but no one is ever pick pocketed, and everyone keeps good backups of their phone"
@mhoye @rj
in reply to Styx

@__Styx__ That's in the exchange format doc, not the exchange protocol doc. (and they're both empty....)
@Styx
in reply to mhoye

The fact that these specs weren't even considered on day one makes me very frustrated with this whole system. I feel like it was all designed around not trusting the user. Understandable to a degree, but substituting that with forcing *everyone* to trust a handful of behemoths, who certainly do not have the good of the human race or the health of the digital ecosystem at heart, is not the correct answer.
in reply to Softwarewolf

@faoluin Yeah. I realize I'm being glib, but passkeys are basically the answer to the question, what if SSH keys had landlords?

And nobody asks that question, or wants an answer to it, but landlords.