josephcsible

Wasn't the cross signing root AAA Certificate Services, which modern browsers had already dropped trust of before this incident?

> A flat cert.pem file (or similar) can't say "distrust this intermediate".

Why does that matter in this case? Can't this be fully mitigated with next to no collateral damage just by removing the trusted roots that signed them?

The fact that GrapheneOS digitally signs their releases doesn't make them not open source. This is indeed a bad situation, but the badness is 100% the fault of Google for having a hardware attestation "feature".

But it's okay for cars to have child safety locks, even though they cause the exact same scenario.

There was nothing deceptive about my statement. Every car has an obvious front door release. There are no cars where the non-obvious back door release is the only way out without electricity.

You're describing the back door release. I'm describing the front door release.

Everyone who's ever ridden with me has thought the emergency release was the regular door handle. It's really that obvious.

Every Tesla ever made has a door release that doesn't require any electricity.

I'll accept passkeys as soon as the manufacturing, import, and sale of any hardware that supports attestation is banned.

Where is it required? If the answer is "nowhere before, but now that passkeys support it, places are starting to", then that's an argument that it's bad, not that it's good. And being able to "use the same passkey spec as everyone else without having to invent their own thing" is bad. I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.

The part unique to passkeys is that the ability to disallow use is already sitting dormant everywhere and literally just needs websites to flip a switch. The other things you mentioned would all take effort for websites to set up.

Indeed, there's nothing wrong with, e.g., passkeys backed by KeePassXC. The problem is specifically that passkeys support attestation, so eventually no websites that you need to use will support passkeys from those pieces of software.

tl;dr: because the government of Ethiopia likes having a monopoly on it and so won't let anyone export it to be grown elsewhere.