Crossposted from https://feddit.org/post/36692057

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 2 weeks ago* (last edited 2 weeks ago) (1 child)

Honestly the original post arguing against them makes very valid points that I wasn't expecting to read to the end, even if they probably lost 90%+ of readers with the length that could have been cut down.

Speaking as a GrapheneOS and Linux user, the possibility of remote attestation to stop me from doing so is a legitimately shitty thought.

Been quite a fan of the convenience though as I just hate having to keep my phone on me all the time. So I'm torn, but will continue using them at least until a whiff of big tech buffoonery comes around.

Edit: Ricky's arguments seem sound but I think you can also tack on "for now" to all of them. They also work for Apple so worth mentioning that potential conflict of interest/bias. I'd be curious of GrapheneOS's take.

  • source
  • hideshow 1 child comment
  • [–] 6 points 2 weeks ago

    I agree 100%, this post is not a full rebuttal and does not tackle the concerns directly:

    • The character of the organisations in FIDO does not inspire confidence against lock-in or monopolistic behaviour
    • The possibility of future attestation cutting out those on 'unapproved' software and hardware.

    I agree parts of the tech are good, particularly the anti-phishing, anti-replay measures.

    This post seems to say passkeys are in good hands so nothing can go wrong, but I don't think that's enough.

  • source
  • parent