You guys conveniently ignores the fact that Apple and Google are still the gatekeepers in that scenario.
Re:Tailscale doesn't want your password
by doublepg23 on Thursday June 08, 2023 @12:06AM
(#36237049)
Yes you need to trust your operating system developer to some extent.
If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?
Re:Tailscale doesn't want your password
by __MatrixMan__ on Thursday June 08, 2023 @01:03AM
(#36237438)
Suppose one does trust their OS developers. And they want to use some passkey-protected service.
Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust.
Seems like that should be up to the user, not the service.
The user picks the passkey, don't they? Android, Apple or Microsoft. Or Yubikey, or another token.
The concern is not about trust but gatekeeping the providers.
For example in the case of email, you generaly dont worry about google reading your email but we should definitely be concerned if gmail allows send & recieve from only few domains or providers it chooses.
But no more than they are the gatekeepers of your password when you use their keyboard software, right?
Re:Tailscale doesn't want your password
by iknowstuff on Thursday June 08, 2023 @12:02AM
(#36237031)
How so
Apple just extended their Credential Provider API such that passkeys can now be synced using external providers, meaning password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. So you can choose to sync your passkeys with whatever your favorite password manager is.
See this page: https://developer.apple.com/passkeys/
And Google announced a similar API a month or two ago.
See the section titled "Passkey support for Android apps" on this page: https://developers.google.com/identity/passkeys/supported-en...