Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.
When something wants too much power, you must avoid.
FIDO 2 level 2 also requires the supply chain documented and a bunch of expensive certificates, which locks small vendors and open hardware implememtations out.
So… Uh… What’s a passkey? The article is saying they’re pure evil. Everyone here is saying they’re good. Everyone knows what they are except for me.
What’s the difference between a passkey and a password?
As the article states, they’re an extremely malicious solution to a problem that has better, simpler, and easier to understand solutions.
It’s also a very good solution to the “problem” of users being able to do things our corporate overlords don’t want us to do.
In short, they’re even worse malware than the ones they’re sold as protecting us from.
Enshittification manifest.
problem that has better, simpler, and easier to understand solutions.
Can you give an example?
Amazon/whatever login:
- email: koalalover@schmeemail.com
- password: hunter2
Email login:
- username: chlamidiyasux
- password: hunter3
There. You’ve solved 90% of online fraud that begins with website(s) leaking your credentials and someone combining leaks to gain access to everything in your life via your email (including bank, socials, porn habits, whatever).
How do you suggest enforcing it?
Enforcing what? It’s up to your email service to adopt the change. The way it currently works was probably okay for the early days of the internet when people had just started using emails, but now that so much private and sensitive financial information passes through your email account, it makes little sense that the same credential you use to login to your email account (email id) is also what you must use when some random website forces you to register in order to access it, just so they can send you massive volumes of unsolicited spam.
Certainly a simpler change with more potential to do good relative to the ease of enforcing a convoluted passkey-slash-usb-slash-save-this-file-somewhere-safe implementation
I don’t understand what will stop the users from using same passwords for both services
SQRL, been around before passkeys, it’s portable, and it’s FOSS.
I wish SQRL was more commonly used.
Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
Healthequity tried forcing this passkey garbage on me, and they wouldn’t allow me to manage investments over the phone, so I ended up transferring everything to a different HSA provider. Not giving in. I love TOTP though.
Based
Basically the problem is that Passkeys are designed to allow a particularly bad enshittification once everyone uses them. So it’s not about downsides of using them now, but about them being used in general and then abused.
I like the article and agree with the problem, but I’m skeptical that this works as a strategy to fix the problem. First off, individual responsibility or boycott doesn’t really work. Most people will just use what their phone gives. Second if the corporations do want to do this, they could implement it separately in their apps, like twitter or google chrome requiring quasi-attested “homebrew” passkeys stored in cryptoprocessors. Ultimately I do not think we have any power to prevent them from doing that.
The time of democracy and pluralism is over. We’re already seeing the author of the article being maligned and personally attacked for talking about AI - how dares he? On all fronts we have lost the culture war and lost power, economic power, information power like access to truth.
