Re:Passkeys: The Beginning of the End of the Password
by dcow on Wednesday May 03, 2023 @01:44PM
(#35805385)
And certain hardware from certain platform vendors doesn't allow exfiltration of private key material. Though I don't think this can be specified by the relying party so that's how Apple stores all keys in keychai. I sincerely hope it remains best practice for relying parties to not require/use the platform attestation feature to lock users onto "trusted" platforms.
[ Parent
| on HN ]
Re:Passkeys: The Beginning of the End of the Password
by lxgr on Wednesday May 03, 2023 @01:53PM
(#35805469)
Device binding can be required by relying parties! They can just refuse to accept credentials without attestation statements signed by a trusted party.
My government e-signature service does that: I can’t even use a Yubikey, ironically, because that’s not "FIDO level 2 certified". I had to buy a more or less completely unknown brand instead (of which a government affiliate is apparently the exclusive reseller in my country…)
Re:Passkeys: The Beginning of the End of the Password
by dcow on Thursday May 04, 2023 @11:03AM
(#35816493)
That's more like vendor binding. Apple’s credentials aren’t device bound so “pinning” to Apple as a vendor by requiring attestation doesn't ensure a credential is device-bound. Not that you don’t have a point, generally.