Ferret7446

This is ignorant fearmongering. Attestation has existed for decades, for enterprise use cases. Now decades later, people discovering attestation for the first time are panicking. If you had panicked a decade ago, that reaction might have had more merit.

1. It's not that complicated

2. The complexity in the standard is there to ensure things are done securely (think: not doing password checking via comparison loop).

3. The unnecessarily complexity in individual implementations in websites and passkey stores is due to general baseline corporate "incompetence".

The same as using a browser to visit a website. Depends entirely on what data your client sends to the server and how unique that data is.

> The attestion part only serves to strengthen to Google/Apple duopoly

That's strange, since neither of them are a big player in the attestation enabled key manufacturer market. AFAIK Apple doesn't even make keys, and barely anyone uses Google's keys. You even mention Yubikey, yet somehow think Google and Apple have a duopoly here.

That has nothing to do with the standard. Any website can invent its own proprietary authentication extension and try to force it on its users. If a website wanted attestation and the standard didn't have it, they'd just make their own extension. See Apple with Thunderbolt.

That's entirely a problem with one implementation and not the standard. It's like complaining Torx is bad because one manufacturer adds stabby bits to the handles of their Torx screwdriver.

> Into a hash algorithm not to a remote server.

You know what MITM is, yes? There are a ton of points between you and that hash algorithm, and any single one immediately and permanently compromises you.

Meanwhile passkeys are completely invulnerable.

> Passkeys have to be online to enroll additional keys

No they don't? A passkey is fundamentally just a private key pair, which can be copied around just like a very long password. Of course if you store it inside one hardware enclave and want to move it to another hardware enclave you have a problem, but for software implementations it's simply a client UX issue.

> Attestation is certainly a stain on the WebAuthn spec

Attestation is necessary for corp use cases. Adding it as an option to WebAuthn is better than forcing more standards to be developed.

Break pads on ICE wear out slower than EV due to torque and weight difference (but also greatly subject to driving style of course). Similarly EV tires wear out faster creating lots of very bad pollution.

Forever stamps guarantee delivery forever (subject to terms and conditions on weight/size). Regular stamps denote value, e.g. 50 cents. They will always be usable but you will need to match the inflation of prices (e.g., mailing a letter might be 50 cents in the past but 100 cents in the future)

Numbers for demonstration only

Not true due to induced demand. Traffic increases when more lanes are added to a highway. The alternative to $200 in AI costs is not $20,000 in labor costs. The alternative is nothing because the work was never worth $20,000. So the AI did not eliminate $20,000 worth of hypothetical labor.

AI creates demand for things that didn't exist previously

They have unlocked value by paying for their AI subscription. They paid $X and using it produced for themselves more than $X worth of value

That is not really how agents work? You can't reliably stop an agent from writing out its context and even if you could that would just make the agent horrible and unusable at performing tasks in general (e.g. delegating to subagents)

I don't think export is necessary. Most of the value is in the context, you can always prompt your agent to vomit all of its context out into markdown files in some repo and then pass it on to the next agent