deltoidmaximus
Joined 11 months ago
Joined 11 months ago
Why was this not a problem in the past? I know covid and tariffs have changed the supply picture a lot but I was vaguely under the impression there was some kind of parts availability requirement for manufacturers.
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
https://github.com/keepassxreboot/keepassxc/issues/10406
"The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations)."
"This implementation is not spec compliant and has the potential to be blocked by relying parties."
Proponents keep trying to hand wave away the attestation lock-in problem as some vague faraway threat that we may never encounter. It isn't. It's the actual plan.
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
"Once certification and attestation goes live, there will be a minimum functional and security bar for providers."
You don't get to decide how to use your passkeys, some on else does.
Of course not, you still have some control over those FIDO2 hardware keys and they don't lock you to a limited set of devices. That's what the attestation is for, to allow banning the use of sign-in with anything but a couple megacorp providers. The few small time hangers on will be expelled in time. They're useful idiots for the adoption phase.
Notice that after lots of complaining about there being no way to transfer keys in the spec they developed some planned working group that will in the end only allow transferring from Google/Microsoft/Apple and maybe a few other dumpster companies. They aren't going to give that control up.
The reasonable position will be slow marched into hell same as the rest of them, just a few steps behind.
The worst part is I've seen search other video sites that used to surface exact titles stop working around the same time. I'm not sure how to reliably find things I know are there anymore.