People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.
While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.
Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.
there’s formats other than TPM like Apple and FIDO U2F, so I don’t think Apple, Yubikey (which chairs the standard’s working group), and the password manager industry (which already does passkeys) would just let that happen.
i am not convinced regarding TPMs
i am not convinced regarding TPMs, and I agree with the FSF on 90% of other things they say. the essay assumes that making a DRM-free copy will be made hard enough that it’s very impactful (“no excuse for the system” doesn’t really faze me). (c.f. PDFs already technically support prohibiting copying. Nearly all PDF readers support overriding this feature. c.f. email read receipts. c.f. the massive multieclecticism of software to open the same type of document and the aging hulk that is most companies’ IT infrastructure. c.f. “Microsoft quietly extends Windows 10’s extra security updates program for free”.) even if that somehow does happen, partly thanks to how inconvenient that’d make sharing and how companies often need a dozen people to access the same document, there will be somehow a way to share keys.
it’s not something the average citizen needs or uses a lot, unlike potentially passkeys
i would certainly say the average citizen uses HTTPS a lot
Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be
(context for onlookers: Let’s Encrypt is the most popular certificate authority, while the analogous to attestation is the concept of certificate authorities and not any one certificate authority.)
Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016, while the current HTTPS standard with certificate authorities had been around since 2000. Passkeys, 2021. I think fairness is something the world needs.
Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016,
I wouldn’t agree HTTPS was unproblematic before Let’s Encrypt existed, so I’m not sure where you are going with this. The average person doesn’t need a HTTPS cert issued, which I would say is comparable to the average citizen using a passkey. If only some spaces, e.g. enterprise, use them then it’s not a real problem. But that’s why it seems problematic to me once passkeys are pushed for general use.
you’ve also missed the point of
I don’t think that I did, but my apologies if that is the case.
no, i was saying Let’s Encrypt solved HTTPS’s problems. before it HTTPS had the problems people claim passkeys’ attestation certificate chain has. it is very possible an authority equivalent to Let’s Encrypt will come about within the 16 years after 2021.
the average person doesn’t need an passkeys certificate issued either. using a passkey is the equivalent of HTTPS’s TLS packets, not making a new certificate.
I would argue that is different because an Https server doesn’t scale as much as a user login. Also, as someone that had to rely on things like “letsencryp” free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.
I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn’t add any security for the users.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)
Like, yeah, GNU/FSF tend to be radical with many opinions and that’s not everyone’s cup of tea. But I feel like this article has a point.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.
While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.
Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.
Anyway, that’s just my opinion.
there’s formats other than TPM like Apple and FIDO U2F, so I don’t think Apple, Yubikey (which chairs the standard’s working group), and the password manager industry (which already does passkeys) would just let that happen.
i am not convinced regarding TPMs
i am not convinced regarding TPMs, and I agree with the FSF on 90% of other things they say. the essay assumes that making a DRM-free copy will be made hard enough that it’s very impactful (“no excuse for the system” doesn’t really faze me). (c.f. PDFs already technically support prohibiting copying. Nearly all PDF readers support overriding this feature. c.f. email read receipts. c.f. the massive multieclecticism of software to open the same type of document and the aging hulk that is most companies’ IT infrastructure. c.f. “Microsoft quietly extends Windows 10’s extra security updates program for free”.) even if that somehow does happen, partly thanks to how inconvenient that’d make sharing and how companies often need a dozen people to access the same document, there will be somehow a way to share keys.
on that note (of my last sentence under the spoiler), you’ve also missed the point of https://lemmy.dbzer0.com/post/76949971/28679239 , which is not the first paragraph.
i would certainly say the average citizen uses HTTPS a lot
(context for onlookers: Let’s Encrypt is the most popular certificate authority, while the analogous to attestation is the concept of certificate authorities and not any one certificate authority.)
Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016, while the current HTTPS standard with certificate authorities had been around since 2000. Passkeys, 2021. I think fairness is something the world needs.
I wouldn’t agree HTTPS was unproblematic before Let’s Encrypt existed, so I’m not sure where you are going with this. The average person doesn’t need a HTTPS cert issued, which I would say is comparable to the average citizen using a passkey. If only some spaces, e.g. enterprise, use them then it’s not a real problem. But that’s why it seems problematic to me once passkeys are pushed for general use.
I don’t think that I did, but my apologies if that is the case.
no, i was saying Let’s Encrypt solved HTTPS’s problems. before it HTTPS had the problems people claim passkeys’ attestation certificate chain has. it is very possible an authority equivalent to Let’s Encrypt will come about within the 16 years after 2021.
the average person doesn’t need an passkeys certificate issued either. using a passkey is the equivalent of HTTPS’s TLS packets, not making a new certificate.
So why shouldn’t we tell people to boycott the tech until then? Even then, that doesn’t solve the threat of a hardware attestation toggle.
I disagree.
I would argue that is different because an Https server doesn’t scale as much as a user login. Also, as someone that had to rely on things like “letsencryp” free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.
I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn’t add any security for the users.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device “TPM”: https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker …in regular customer machines.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
This is what people seem to be missing, I haven’t seen a rebuttal to this problem.
This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)
Like, yeah, GNU/FSF tend to be radical with many opinions and that’s not everyone’s cup of tea. But I feel like this article has a point.