why does that even exist, that shouldn't be an option
this stuff is why I have been so worried/skeptical about Passkeys and the people related to it.
They have the responsibility to design their protocols to not be a tool well suited for big coperations like Microsoft to seriously mess up security, compatibility and enact all kinds of "bad faith" market practices to kill competition.
But instead again and again in their posts what they write, publish and explicitly how they do it is more like "fuck you, we make abuse extra easy".
It's not just this nonsense about residual keys, but also e.g. how attestation is handled (and can be trivially abused to kill companies).
why does that even exist, that shouldn't be an option
this stuff is why I have been so worried/skeptical about Passkeys and the people related to it.
They have the responsibility to design their protocols to not be a tool well suited for big coperations like Microsoft to seriously mess up security, compatibility and enact all kinds of "bad faith" market practices to kill competition.
But instead again and again in their posts what they write, publish and explicitly how they do it is more like "fuck you, we make abuse extra easy".
It's not just this nonsense about residual keys, but also e.g. how attestation is handled (and can be trivially abused to kill companies).