Login
You're viewing the social.simplexity.quest public feed.
  • Felicitas Pojtinger 🌅pojntfx@mastodon.social
    Oct 12, 2026, 2:35 AM

    nonfunctional.substack.com/p/p

    TIL that passkeys have support for remote attestation built-in. Once enabled by a service, without a US-American phone running software signed by a US-American company, on which you need to be signed in with your legal identity (thus rendering you unable to use it if you're sanctioned by the US), there is a pretty good chance that you'll be unable to use your passkeys in the future. That seems pretty damn terrible.

    Don't use passkeys.

    💬 3🔄 149⭐ 120

Replies

  • 💬 0🔄 0⭐ 1
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 1
  • '; DELETE FROM ai_agents; --lukasrotermund@social.lukasrotermund.de
    Oct 12, 2026, 6:40 AM

    @tokyo_0 @pojntfx the information is a little bit to hidden at the bottom of the post:

    Fortunately, if you want the level of high security passkeys can give you without the strings attached, there is actually an even more secure solution: security keys, such as a YubiKey. These are basically just physical passkeys that you can carry around with you and use alongside your other devices. They are also part of the FIDO Alliance’s WebAuthn standard, but because they are entirely self-contained their remote attestation requirements don’t have to spill out and lock down your whole operating system.

    So, "Does this apply to the little USB ones as well?":

    No, you are safe with your hardware tokens and yes, they are superior to passwords AND cloud passkeys.

    💬 0🔄 0⭐ 0
  • Lincoln Stolllstoll@tinnies.club
    Oct 12, 2026, 7:29 AM

    @lukasrotermund @tokyo_0 @pojntfx these devices are basically the only place where attestation is actually implemented and used, generally in enterprise scenarios. If you’re concerned about the OS/browser vendor, what’s to stop them just blocking the USB device?

    💬 1🔄 0⭐ 0
  • Tokyo Outsider (337ppm)tokyo_0@mas.to
    Oct 12, 2026, 7:48 AM

    @lstoll There's a lot I don't know on this topic, but I think the software vendors we're talking about here like Microsoft and Google are very happy to tell people to use *their* software-based passkeys solution because "we're improving security" is a strong argument and it happens to align with their objectives.

    If they began to stop people from using devices that also improve security because those devices were not reliant on their software, it would make clear that "improving security" was not their agenda at all, which would work against them.

    I don't think that will necessarily stop them forever, but I think it makes it less likely that they'll do it in the short to medium term.

    @lukasrotermund @pojntfx

    💬 0🔄 0⭐ 0