News for hackers. Stuff that matters.

A comment on We should have the ability to run any code we want on hardware we own. Parent comment

Re:We should have the ability to run any code we want on har... by lucideer on Monday September 01, 2025 @06:11AM (#45091311)
Passkeys would be better without remote attestation, no doubt. But remote attestation is not only optional but also, passkeys are not a prerequisite for requiring remote attestation.

Lots of services that don't support passkeys currently require remote attestation. Boycotting passkeys (an open, possibly beneficial tech that doesn't require remote attestation) will not prevent bad actors from requiring remote attestation (with or without passkeys).

[ Parent | on HN ]
Re:We should have the ability to run any code we want on har... by ori_b on Monday September 01, 2025 @06:13AM (#45091320)
Agreed. Boycotting them is necessary but insufficient.
[ Parent | on HN ]
Re:We should have the ability to run any code we want on har... by lucideer on Monday September 01, 2025 @02:48PM (#45095473)
No, boycotting them is entirely orthogonal to the issue. Passkeys have no role in ensuring that we do or don't rely on remote attestation - they're two totally separate considerations.

Passkeys have many benefits over current alternatives for auth, & the inclusion of remote attestation doesn't make them worse than current auth because all current auth can be coupled to remote attestation.

Continue to oppose remote attestation but do use Passkeys. They're a massive improvement.

[ Parent | on HN ]