Being able to zero-effort cleartext a passkey strips it of the HSM-lite properties that make it safer than passwords. Attestation reintroduces those properties, by restricting use to those that adhere to them. Of course they’re going to pivot to attestation — there was no other possible outcome given the passion invested into total freedom — but it was still kind of them to try and let people voluntarily adhere to their principles first. Non-compliance is too valuable a niche for that to work, both for believers and for profit, so of course here we are.
I’ve already posted at length on HN about the risks of treating attestation as evil and refusing to discuss its benefits at all, and how that manner of engagement will lead to it being widely adopted over the objections of an uncoordinated minority. The sky is falling, yet no one discusses how freedom and attestation might coexist, and so the majority use case (end users) is winning.
I still expect the big wake up call is going to be in a couple years when Steam enables attestation in their Linux product and VAC begins requiring it, but at least the ripples of LXC’s approach are being seen at all.
I’ve already posted at length on HN about the risks of treating attestation as evil and refusing to discuss its benefits at all, and how that manner of engagement will lead to it being widely adopted over the objections of an uncoordinated minority. The sky is falling, yet no one discusses how freedom and attestation might coexist, and so the majority use case (end users) is winning.
I still expect the big wake up call is going to be in a couple years when Steam enables attestation in their Linux product and VAC begins requiring it, but at least the ripples of LXC’s approach are being seen at all.