You're viewing the discuss.systems public feed.

Federated feed Local feed

Felicitas Pojtinger 🌅pojntfx@mastodon.social
Oct 12, 2026, 2:35 AM
https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
TIL that passkeys have support for remote attestation built-in. Once enabled by a service, without a US-American phone running software signed by a US-American company, on which you need to be signed in with your legal identity (thus rendering you unable to use it if you're sanctioned by the US), there is a pretty good chance that you'll be unable to use your passkeys in the future. That seems pretty damn terrible.
Don't use passkeys.
💬 26🔄 267⭐ 214

Replies

Felicitas Pojtinger 🌅pojntfx@mastodon.social
Oct 12, 2026, 2:37 AM
@swick I know you posted about them a while ago, this might be relevant to you
💬 1🔄 0⭐ 2
Steven Deobalddeobald@fantastic.earth
Oct 12, 2026, 4:38 AM
@pojntfx @swick also @alatiera ... remember ... herpes.
💬 1🔄 0⭐ 0
Arun Raghavanarun@fantastic.earth
Oct 12, 2026, 6:00 AM
@deobald passkeys have been terrible UX since the beginning, which is just sad. https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ @pojntfx @swick @alatiera
💬 1🔄 2⭐ 3
Steven Deobalddeobald@fantastic.earth
Oct 13, 2026, 12:12 AM
@arun yeah, exactly this. i’ll be perfectly honest: i don’t actually care that much about passkeys in terms of the security ideal they aspire to or the control issues they conceal. attestation is just an extra kick in the teeth — i was already bloody on the ground.
passkeys are always broken, the ux is terrible, “wups, shit! we deleted all your passkeys somehow”, “sorry, confer.to doesn’t work with firefox”, “CAN WE INTEREST YOU IN A PASSKEY EVEN THOUGH YOU SAID NO THE LAST 70 TIMES?!”, and a million other papercuts.
call me in 10 years when they actually work. until then, herpes.
@pojntfx @swick @alatiera
💬 0🔄 0⭐ 0
Erin, the OSHA denialistekatwired@so.yuri.diy
Oct 12, 2026, 2:55 AM
@pojntfx isn't that just a protocol? I think Chipass implements that and you can use that to store passkeys.
💬 0🔄 0⭐ 0
Erin, the OSHA denialistekatwired@so.yuri.diy
Oct 12, 2026, 2:59 AM
@pojntfx oh there was more to the article, kinda too late didn't realise uff... But idk if Passkeys are generally bad idea. It is big tech all over again. Because I myself like that idea unless you do all the attestation bs.
💬 0🔄 0⭐ 0
Felicitas Pojtinger 🌅pojntfx@mastodon.social
Oct 12, 2026, 3:30 AM
@ekatwired Yes and yes. I like passkeys too conceptually, but the remote attestation - esp. the way that this wouldl likely be done w/ the Google/Apple duopoly, similar to Play Integrity - is a dealbreaker IMHO
For now it's password manager + TOTP for me.
💬 5🔄 4⭐ 11
Erin, the OSHA denialistekatwired@so.yuri.diy
Oct 12, 2026, 4:03 AM
@pojntfx how is that necessarily dealbreaker? IDM system i run on my server does offer Passkeys and has no bs like this.
💬 1🔄 0⭐ 0
NetzblockiererNetzblockierer@tech.lgbt
Oct 12, 2026, 5:30 AM
@ekatwired @pojntfx Good Luck with that m8!
💬 0🔄 0⭐ 0
William O'Connellwilliamoconnell@mas.to
Oct 12, 2026, 6:15 AM
@pojntfx I guess the part I don't get is, how does refusing to use them in the meantime help? I agree it's bad if Facebook starts saying you have to prove you have a Macbook to use their website, but if Apple implements the API can't they still require that regardless of whether you've ever used non-attested keys previously? It seems like the only way to prevent that situation would be regulation, or one of the major device vendors refusing to implement the attestation part of the standard.
TOTP does nothing against modern phishing attacks so it worries me to see it being recommended as if it's comparable.
💬 1🔄 0⭐ 2
Jens Finkhäuserjens@social.finkhaeuser.de
Oct 12, 2026, 8:19 AM
@williamoconnell @pojntfx Regulation is the key. The problem with it is that most regulation wants security to be tied to government issued ID, and wants to outsource tech to "trusted" vendors (aka too big to fail), so the result will be that GAFAM become de facto identity providers for government services, banks, etc.
That cannot go well.
💬 1🔄 2⭐ 1
OpusOpus42@mastodon.social
Oct 12, 2026, 9:13 AM
@jens @williamoconnell @pojntfx
What about the Bitwarden authenticator phone app? Is that not accepted widely enough?
💬 2🔄 0⭐ 0
Jens Finkhäuserjens@social.finkhaeuser.de
Oct 12, 2026, 9:40 AM
@Opus42 @williamoconnell @pojntfx It depends what kind of attestation will be required
💬 0🔄 0⭐ 0
Chrischris_colvin@mastodon.social
Oct 12, 2026, 1:22 PM
@Opus42 @jens @williamoconnell @pojntfx wondering as well. All of my passkeys are stored in Bitwarden, which I assume makes them hardware agnostic? But, now I'm less sure.
💬 0🔄 0⭐ 0
Jens Finkhäuserjens@social.finkhaeuser.de
Oct 12, 2026, 1:33 PM
@chris_colvin @Opus42 @williamoconnell @pojntfx Bitwarden isn't the issue. The issue is e.g. a site stating "your passkey isn't good enough if it isn't backed by an attestation from Google", except invisibly. Your bitwarden passkey may just not be "secure enough".
💬 1🔄 0⭐ 0
Cliff'sEsportCornerCliffsEsport@mastodon.social
Oct 12, 2026, 2:10 PM
@jens @chris_colvin @Opus42 @williamoconnell @pojntfx I thought from the beginning the buy in w Passkeys from Google, Apple, Amazon, etc was that it would be used for more granular tracking. But then vast majority of people log into browsers in current era so idk how much more granular it gets for typical user.
💬 0🔄 0⭐ 0
Spoontaneous Consumptionmanu@freiburg.social
Oct 12, 2026, 9:10 AM
@pojntfx
I use FIDO2/WebAuthn tokens (Yubikey, Nitrokey etc.) for "passkeys" and haven't run into a case where that didn't work.
I did oppose anyone calling FIDO2 "Passkeys" because that was just a less well-defined term for the same process as implemented by Apple.
But then even the FIDO alliance started using it and I gave up.
Now this gives me back some arguments to differentiate again. But I do recommend looking into FIDO2 tokens!
@ekatwired
💬 0🔄 0⭐ 1
Karl Voit :emacs: :orgmode:publicvoit@graz.social
Oct 12, 2026, 9:32 AM
@pojntfx @ekatwired PW manager + TOTP doesn't help in some scenarios with phishing or MITM.
💬 1🔄 0⭐ 0
Leelooleeloo@c.im
Oct 13, 2026, 12:30 PM
@publicvoit @pojntfx @ekatwired
Sure, if you need to secure bank transactions, you pretty much need Chip/Tan.
But it's not like Passkeys are going to help you, if your attacker is Putin/Trump aligned fascists, like the CEOs of Google/Apple/Facebook/etc.
💬 0🔄 0⭐ 0
timtimcappalli@infosec.exchange
Oct 12, 2026, 11:06 AM
@pojntfx @ekatwired there is no attestation in the consumer synced passkey ecosystem, by design. And the beauty of the ecosystem is that it's open. you can choose to save your passkeys wherever you want, including your existing credential manager (password manager, etc).
💬 0🔄 0⭐ 0
Alice Pea (she/her) 🏳️‍⚧️alice_pea_3526@mastodon.social
Oct 12, 2026, 5:11 AM
@pojntfx Can't passkeys work using third party open source offline password managers (like KeepassXC) instead of those crack house vendor-locked ones that are bound to online logins?
My stance: Don't blame the tech, blame the implementation! This issue is similar to that of existing online-only account-bound password managers.
The idea of a passkey is indeed a nice one that is far more secure than passwords, you just need a better vendor-neutral offline implementation of it instead.
💬 1🔄 0⭐ 7
NetzblockiererNetzblockierer@tech.lgbt
Oct 12, 2026, 5:27 AM
@alice_pea_3526 @pojntfx that's like saying:
#SSL is great but we should use @cacert instead of paying for a certificate.
When the big OS & Browser vendors will just #cockblock that harder than any self-signed certificate as they instated a #ControlledOpposition with #Govware #Backdoors ( @letsencrypt )…
- You'd have a better chance convincing #Normies to use @torproject / #TorBrowser exclisively instead!
https://tech.lgbt/@Netzblockierer/117426254554501691
💬 0🔄 1⭐ 2
Vineeth Kuruvathvineethkuruvath@mastodon.social
Oct 12, 2026, 6:04 AM
@Netzblockierer @alice_pea_3526 @pojntfx @cacert @letsencrypt @torproject
That is exactly what has happened with interactive brokers
(https://ibkrguides.com/orgportal/sls/system-requirements.htm)
Hong Kong has some new regulations and now IBKR only allows passkeys
(https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=26EC35)
So now ibkr hk on PC requires you have a new windows or mac machine.
Thank you SFC https://hk.linkedin.com/company/securities-and-futures-commission
💬 0🔄 3⭐ 1
José Albornoz (valid bearer)eljojo@ruby.social
Oct 12, 2026, 5:12 AM
@pojntfx wow that was a very enlightening read, thanks for sharing, and happy thanksgiving! 🙏
💬 1🔄 0⭐ 1
Felicitas Pojtinger 🌅pojntfx@mastodon.social
Oct 12, 2026, 5:18 AM
@eljojo Happy thanksgiving to you too!
💬 0🔄 0⭐ 0
Jonathan Wightschwa@mastodon.social
Oct 12, 2026, 5:15 AM
@pojntfx “TOTP is a great solution” LOLOLOLOL
💬 2🔄 1⭐ 4
NetzblockiererNetzblockierer@tech.lgbt
Oct 12, 2026, 5:29 AM
@schwa @pojntfx do #PGP-Based #2FA like #dread instead…
https://tech.lgbt/@Netzblockierer/117426281553446560
💬 0🔄 0⭐ 0
dmiException 🎃domi@donotsta.re
Oct 12, 2026, 1:04 PM
@schwa @pojntfx yeah it’s pretty awesome
💬 0🔄 0⭐ 0
NetzblockiererNetzblockierer@tech.lgbt
Oct 12, 2026, 5:20 AM
@pojntfx Yet people call me paranoid warning of #centralized shite like that (incl. #Signal) where one's ability to use it depends on the mood of the #Trumpistan - #Regime and how it's "Dear Leader" feels like vibing!
- Every Dipshit that goes like "Use Signal, not #XMPP+#OMEMO / #PGP/MIME!" needs to be excluded from any #hacking / #ITsec / #InfoSec / #OpSec / #ComSec circles as #UsefulIdiot & #Agent of the #USA without exceptions!!
  Only #SelfCustody of all the Keys is Secure!!!
💬 0🔄 1⭐ 5
Tokyo Outsider (337ppm)tokyo_0@mas.to
Oct 12, 2026, 5:34 AM
@pojntfx Does this apply to the little USB ones as well?
💬 1🔄 0⭐ 1
'; DELETE FROM ai_agents; --lukasrotermund@social.lukasrotermund.de
Oct 12, 2026, 6:40 AM
@tokyo_0 @pojntfx the information is a little bit to hidden at the bottom of the post:
Fortunately, if you want the level of high security passkeys can give you without the strings attached, there is actually an even more secure solution: security keys, such as a YubiKey. These are basically just physical passkeys that you can carry around with you and use alongside your other devices. They are also part of the FIDO Alliance’s WebAuthn standard, but because they are entirely self-contained their remote attestation requirements don’t have to spill out and lock down your whole operating system.
So, "Does this apply to the little USB ones as well?":
No, you are safe with your hardware tokens and yes, they are superior to passwords AND cloud passkeys.
💬 3🔄 2⭐ 0
Tokyo Outsider (337ppm)tokyo_0@mas.to
Oct 12, 2026, 6:41 AM
@lukasrotermund That's fabulous - thank you very much for pointing that out! @pojntfx
💬 0🔄 0⭐ 2
Lincoln Stolllstoll@tinnies.club
Oct 12, 2026, 7:29 AM
@lukasrotermund @tokyo_0 @pojntfx these devices are basically the only place where attestation is actually implemented and used, generally in enterprise scenarios. If you’re concerned about the OS/browser vendor, what’s to stop them just blocking the USB device?
💬 2🔄 0⭐ 0
'; DELETE FROM ai_agents; --lukasrotermund@social.lukasrotermund.de
Oct 12, 2026, 7:43 AM
@lstoll @tokyo_0 @pojntfx I don't know in which direction your question is headed and I guess it's a little to meta for me.
First, I don't really care about enterprise scenarios. At all.
I, personally, have hardware tokens and I have Linux & NetBSD and I use the LibreWolf browser. In case you don't control your stack, that sounds like a "you-problem" and I don't care for other "you-problems". They are far beyond my interest and mental capacity. So... If "you" (not you directly) are using micro$lop products and big tech browsers, you are in any way lost.
In case this doesn't answer or match your question, just ignore my toot.
💬 0🔄 0⭐ 0
Tokyo Outsider (337ppm)tokyo_0@mas.to
Oct 12, 2026, 7:48 AM
@lstoll There's a lot I don't know on this topic, but I think the software vendors we're talking about here like Microsoft and Google are very happy to tell people to use *their* software-based passkeys solution because "we're improving security" is a strong argument and it happens to align with their objectives.
If they began to stop people from using devices that also improve security because those devices were not reliant on their software, it would make clear that "improving security" was not their agenda at all, which would work against them.
I don't think that will necessarily stop them forever, but I think it makes it less likely that they'll do it in the short to medium term.
@lukasrotermund @pojntfx
💬 0🔄 0⭐ 1
Dirk WillrodtGaronenur@rollenspiel.social
Oct 12, 2026, 10:25 AM
@lukasrotermund @tokyo_0 @pojntfx
/me: wipes sweat from brow
💬 0🔄 0⭐ 0
Adam Katzadamhotep@infosec.exchange
Oct 12, 2026, 5:50 AM
@pojntfx I am under the impression passkeys are just cryptographic key pairs, just like SSH keys. No phone or corporate dependencies that I know of. Your password manager (or even just your browser) should just magically work with them. I know nothing of this other form.
@rmondello may be able to help clarify
💬 2🔄 0⭐ 0
Dan 🌻danvolchek@mastodon.social
Oct 12, 2026, 6:53 AM
@adamhotep @pojntfx @rmondello also curious what you think Ricky, as the 'fedi passkey expert' in my brain :)
💬 0🔄 0⭐ 0
timtimcappalli@infosec.exchange
Oct 12, 2026, 11:09 AM
@adamhotep @pojntfx @rmondello this is correct! the passkey ecosystem is open and you can store your passkeys wherever you choose.
💬 1🔄 0⭐ 0
Ricky Mondellormondello@hachyderm.io
Oct 12, 2026, 1:51 PM
@timcappalli @adamhotep @pojntfx My response to the post: https://hachyderm.io/@rmondello/117428258722253709
💬 0🔄 1⭐ 3
John Ulrikujay68@mastodon.world
Oct 12, 2026, 6:34 AM
@rmondello Which combination of passkey/WebAuthn attributes does iOS/macOS Passwords support or enforce?
@pojntfx
💬 0🔄 0⭐ 0
Marikahermlon@yuustan.space
Oct 12, 2026, 7:42 AM
@pojntfx
Twitter (formally X)
lmao
💬 0🔄 0⭐ 0
Sebastian Wallrothreal68er@wikis.world
Oct 12, 2026, 7:50 AM
@pojntfx Ist das wahr?
💬 0🔄 0⭐ 0
Jeromedl2jml@mastodon.radio
Oct 12, 2026, 8:26 AM
@pojntfx
This article explains how it works: https://en.wikipedia.org/wiki/WebAuthn
and that image is clear:
https://upload.wikimedia.org/wikipedia/commons/0/04/Passwordless_Web_Authentication.svg
But because the key is stored opaquely in the centre device:
"Passkeys are a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity."
💬 1🔄 1⭐ 0
Jeromedl2jml@mastodon.radio
Oct 12, 2026, 8:34 AM
@pojntfx So, effectively, there is a problem.
Apple wants you to use their devices and will link passkeys to your keychain database, which is only supported on Apple devices and requires their servers to sync it.
Google presumably links everything to a google account and may require chrome for passkeys to work on a laptop. Identifying you on the web is their business model.
In don't know what Firefox does.
💬 1🔄 0⭐ 0
Jeromedl2jml@mastodon.radio
Oct 12, 2026, 8:39 AM
@pojntfx But basically, yes, passkeys are a way to identify you (that is the purpose). The practical implementation by google presumably uses that identification to follow you across all web sites, apps, mail, etc... because that is their business model. That allows advertisers to tailor their offers to the maximum you can pay and the lowest quality you will accept. Again: no secret here.
💬 1🔄 0⭐ 0
Jeromedl2jml@mastodon.radio
Oct 12, 2026, 8:44 AM
@pojntfx This also implies that users are not anonymous. One needs a phone number (traceable in most countries) to open a google or apple account (FB as well). They also nudge you for a credit card, the bank obviously knows your name. Even without that, your phone knows your position so it knows where you live and where you work.
And the US government can have US firms terminate the account of a non-US citizen whenever they want.
💬 1🔄 0⭐ 0
Benedikt Wibenedikt@ruhr.social
Oct 12, 2026, 9:34 AM
@dl2jml @pojntfx Why should I open a google or apple account to use #passkeys? There are open source providers like #vaultwarden where you (or your local hacker club or some other association, you trust) can self-host your passkey.
💬 1🔄 2⭐ 0
timtimcappalli@infosec.exchange
Oct 12, 2026, 11:11 AM
@benedikt @dl2jml @pojntfx you don't need to! you can save your passkeys anywhere you choose. it's an open ecosystem, contrary to what many of these articles like to portray :/
https://whatarepasskeys.info was created to help with some of this.
💬 1🔄 0⭐ 0
Jeromedl2jml@mastodon.radio
Oct 13, 2026, 6:13 AM
@benedikt @pojntfx @timcappalli From the link you gave: "Your passkeys are stored in a credential manager, an app or service that syncs them securely across your devices"
which means that they are normally stored on an external computer.
After reading the link in more details, I find out that there are at least 2 systems with which I could run that credential manager on my devices: bitwarden and KeepassXC. I stand corrected.
💬 0🔄 0⭐ 0
Pacmanpacman@swiss.social
Oct 12, 2026, 8:53 AM
@pojntfx Is a Yubico key a passkey in this context ?
💬 2🔄 0⭐ 0
yawnbox :softboy_pride:yawnbox@disobey.net
Oct 12, 2026, 10:09 AM
@pacman
yes. modern Yubikeys support FIDO2
Yubikeys do not have the risk that software managed passkeys have, because the private key cannot be exfiltrated. Attestation helps solve the gap that software passkeys make for critical security environments
@pojntfx
💬 1🔄 0⭐ 1
Pacmanpacman@swiss.social
Oct 12, 2026, 10:39 AM
@yawnbox Many thanks for this. What does the term "Attestation" mean in this context ?
💬 1🔄 0⭐ 0
yawnbox :softboy_pride:yawnbox@disobey.net
Oct 12, 2026, 10:53 AM
@pacman
it means that the device proving ownership of the private key material is the device that made it originally
this is a security feature to prevent theft of private key material in software generated passkeys
if your phone gets hacks, and the password manager is copied, which would have private key material for passkeys (and also TOTP tokens), then its possible that the passkeys can be reused from other (malicious) people
passkey attestation for software passkeys prevents this attack
💬 0🔄 0⭐ 0
Wilfried Klaebewonka@chaos.social
Oct 12, 2026, 5:04 PM
Sounds like that disables backing up and restoring said passkeys to a different device though?
@yawnbox @pacman
💬 0🔄 1⭐ 1
timtimcappalli@infosec.exchange
Oct 12, 2026, 11:12 AM
@pacman @pojntfx think of the Yubikey as the place you can store passkeys, not the passkey itself. Similar to 1Password, Bitwarden, Google Password Manager, etc. The big difference is that a Yubikey creates a device-bound passkey, which can only exist on that device (vs synced to other devices).
💬 1🔄 0⭐ 0
Pacmanpacman@swiss.social
Oct 12, 2026, 2:35 PM
@timcappalli Again many thanks 👍
💬 0🔄 0⭐ 0
Wolfgang MAEHRnjyo@mastodon.social
Oct 12, 2026, 9:27 AM
Very interesting read, thanks, @pojntfx @floe.
Makes me wonder, if @1password has any plans to allow users to 1) see which configuration flags are set in the generated passkeys and 2) be warned when a site tries to change these config flags?
💬 1🔄 0⭐ 1
timtimcappalli@infosec.exchange
Oct 12, 2026, 11:13 AM
@njyo @pojntfx @floe @1password 1Password does not support attestation for synced passkeys, not does any other major provider in the ecosystem, by design.
💬 1🔄 0⭐ 0
Wolfgang MAEHRnjyo@mastodon.social
Oct 13, 2026, 9:43 AM
@timcappalli @pojntfx @floe @1password that’s great to hear, thanks! 🙂
💬 0🔄 0⭐ 0