this post was submitted on 12 Oct 2026
267 points (84.7% liked)
Privacy
51408 readers
667 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
See I bought a couple of yubikeys, but have zero passkeys becuase I've yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn't risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login). I'd happily use passkeys with yubikey, but I'm not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are 'authorised' and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it's up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can't use something like the 'Solokey hacker'. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn't notice anything unusual with the registration process.
All the sites I've encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn't work so far is l1t forum. I don't know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
If you wanna try it out; use https://webauthn.io/