News for hackers. Stuff that matters.
Re:FIDO Alliance publishes new spec to let users move Passke... by lxgr on Thursday October 17, 2024 @04:30AM (#41867552)
Where are you still seeing attestation?

Both Apple and (I believe) Google threw theirs out when they moved to synchronizing passkeys, and they’re both widely supported by relying parties.

Other than that, I think it’s fair for e-signature etc. services to be able to require a physical, non-synchronizing credential like a Yubikey. With such a service, it’s not just your (as the key owner), but also others’ security on the line when breaches happen.

Re:FIDO Alliance publishes new spec to let users move Passke... by ndriscoll on Friday October 18, 2024 @11:19AM (#41880222)
That's good to hear. I don't see passkeys anywhere right now because browsers don't have software implementations and my computer isn't capable of a hardware one, which incidentally is part of why I'm not a fan of forcing it on people.
Re:FIDO Alliance publishes new spec to let users move Passke... by lxgr on Saturday October 19, 2024 @03:31AM (#41886264)
Bitwarden has a software implementation that’s been working well for me at least in Firefox. I believe it should work in Chrome as well.