It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.
While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.
Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.
I would argue that is different because an Https server doesn’t scale as much as a user login. Also, as someone that had to rely on things like “letsencryp” free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.
I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn’t add any security for the users.
It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.
While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.
Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.
Anyway, that’s just my opinion.
I would argue that is different because an Https server doesn’t scale as much as a user login. Also, as someone that had to rely on things like “letsencryp” free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.
I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn’t add any security for the users.