To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.
If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy.
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!)
Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication:
1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.
Recommended soundtrack for building work: Wii sports theme.
reposting this because holy FUCK if this isn't so goddamn true
Bristol airport.
7 mins from outside to through security *and* I got secondary screened.
Not bad!
I used to work for a Secretary of State (I won't say which) and we had a long running game of office tig. Often, the game would be during inappropriate meetings. My best Tig was using a No10 envelope containing the word TIg after declaring "urgent note from the PM"
Spider-LAN
1980's
🐁 *holding ice against crotch* Dad, how come girl's bikes don't have the bollock-mashing bar
🐺 no need for it lad, they've got nae bollocks
🐁
🐺 not much point putting a bollock masher if there's nae bollocks to mash is there
🐺 be a bloody waste of money
2020's
🐀 *holding ice against crotch* Dad, why
🐁 You know, I asked my dad this when I was your age, and his answer doesn't really fit in this decade. You probably know a couple of girls with bollocks. Maybe a boy with no bollocks. Either way, girls with bollocks get to ride the bikes without the bollock-mashing bar, and boys with no bollocks can ride the bollock masher, in a lot of ways it's a more enlightened time
🐀 Dad what
🐁 I mean these days girls can ride the bollock mashing bikes too
🐁 So can non-binary folk, bollocks or no
🐀 dad
🐁 Anyway times change is what I'm saying
🐁 The important thing is squashing the bollocks
🐀
🐁 Flat
@2001 Here we go, one of my favorite shots of the whole film, and a technical tour de force. It doesn't start out looking like very much, but wait a bit! This is also a very, very long shot at 43 seconds, second in length so far only to Moonwatcher's 56 second "aha!" moment 17 months ago (not counting the opening shot). With that length, this goes until the middle of next month: around Nov 16, 11:07 UTC (3:07 PST) #next2001ShotPrediction
Saw this on work Slack. Maybe it's already floating around Fedi but hey, you can never have too much of a good thing.
Sound up. I'm in hysterics.
No
Fridays always get a thumbs up from me
Edit: link to the original video
https://m.youtube.com/watch?v=_mSbcVQPRXg
HELLO YES I WOULD LIKE TO LISTEN FOR BIRDS IN MY GARDEN AND PUBLISH THAT DATA INTO MY OBSERVABILITY SYSTEM
f Hugo continues to grow at this rate, by 2030 he will no longer fit in the barn. By 2050 he will have grown to the size of Godzilla and could crush humanity.
But if we let the Chinese grow their own Hugo first that would be bad. This is why we must invest 100 trillion dollars in Hugo immediately.
Neighsayers claim Hugo is "just a horse" and "can't save and/or destroy the planet." But it is early days. Hugo technology is constantly getting better.
I wrote a thing, please read.
https://www.linkedin.com/pulse/i-have-problems-apparently-jessica-hebenstreit-pq2hc/
UPDATE: mallory is willing to visit me in person! i've left my FIDO2 security key in the hotel room, and i'll make sure i only tell alice about that by encrypting my message to her with her new key that mallory forwarded me. the only other person who can access my hotel room is the maid, anyway, who i assume is not evil
Do *not* plug the shop vac into the UPS.
Shamelessly stolen from somewhere else
Apropos of nothing at all, I wrote a browser extension that tells you if the parents of the person you're reading about on Wikipedia also have Wikipedia pages.
Am I doing software right?