No need to apologize to me. Raising awareness is my mission goal for discussing attestation at HN. Not to promote it — there’s one specific use case for it that I think is firmly appropriate and PassKeys isn’t that! — but to ensure that people are informed about what’s going on so that it can be evaluated face-on.

Believe this is the goal of pushing towards secure compute like Google’s SafetyNet or Windows 11 with tpm.

Feels like there are some more thematic underpinnings as well like security at the cost of user freedom or at the cost of tinker-ability.

The Windows 11 TPM push parallels macOS and the T2 chip, except years later. Once Win11 is in the majority, I imagine web attestation will start to go live in web banking, because they hate paying for fraud investigations.

But. The silent looming threat I predict that few others seem to see, is that Valve will guaranteed enable TPM w/ secure boot attestation in a future Steam Deck hardware update after everyone bails from Windows 10 to Valve Linux, giving it true standing as a console and overcoming today’s multiplayer lockouts by AAA games (unattested Linux is a godsend for software cheaters compared to Windows), while having captured that market on the pretense of tinkerability with full intentions to betray that unstated assumption in favor of regaining AAA multiplayer support in games.

Similarly, that’s why so many AMD gaming processors already ship with Microsoft’s secure attestation Proton chip from the Xbox inside: if Microsoft wants to end kernel-rootkit anticheat, they have to offer another solution, or else competitive PC multiplayer online gaming dies when Microsoft slams the door on Crowdstrike. Secure attestation, coming to a Steam instance near you. (And not to single out Valve — Epic will go there too!)

Console-grade attestation is coming to computers everywhere, because just as with password theft, it uniformly prevents virtually all software-based cheating. It won’t stop hardware-based cheating, but doi:10.1109/SERE-C.2012.43 and Apple mFI already demonstrated that peripheral attestation can arrive at any time — there just isn’t any point in doing so for Win/Lin gaming when most users aren’t using attestation. Yet.

Sometimes I feel like Chicken Little trying to convey the threat to repurposeability here, but, like, this is what’s coming, because after the Crowdstrike worldwide outage, kernel rootkits are on the way out - and the side effects are going to be devastating. This is why I don’t just say, as one comment below does, “fuck you” to attestation: that approach has no effect and it’s coming for everyone unless more people than I start confronting it and understanding it.

The walls really are closing in though. There's basically no way we can avoid this scenario.

So we don't use passkeys? OK, fine, in 2025 that's possible. But for how long? How many sites and services are going to start requiring this? Will they care if a few HN readers are blocked out?

The only way to prevent this nightmare is to convince tech illiterate people to also avoid passkeys, but good luck! This kind of convenience is too attractive and the downsides are too hard to communicate to them.

The key is to lie. Most tech illiterate people get their approximate knowledge from more tech literate people, who get their knowledge from the technical folk. Tech illiterate people don't know how passkeys work, if we start saying that it's just a way for scammy companies to steal your passwords, that'll eventually become truth.

It’s still possible to avoid this scenario. For example, imagine how conservative tech-hostile politicians would react if they understood how passkeys gives big tech authority over their money. Or when police discover that they no longer have the ability to extract passwords with a wrench. Or how parents won’t be able to access some accounts because the kid stored a passkey outside of iCloud and now it’s parent-proof. Massive outrage is due to tech over this, considering historical trends, but either no one realizes the benefits of them — or everyone doesn’t care because it’s worth not having their password stolen.

The standards body did a really excellent job solving the problem. Is outrage deserved? Is this better or worse than our freedom? I would watch that debate if someone posted a video of a panel discussing the contradictions! Because I’m not sure where I stand, either.

But I just cannot stand the obliviousness that everyone has over attestation. It’s not a done deal yet. I just haven’t seen tech suggest anything to do about it, and that continues to worry.