The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.