Linux

68083 readers

1041 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 7 years ago

MODERATORS

nooter692@lemmy.ml

MarcellusDrum@lemmy.ml

cypherpunks@lemmy.ml

cyclohexane@lemmy.ml

224

Passkeys may require some more research. (lemmy.zip)

submitted 16 hours ago by Microtonal_Banana@lemmy.zip to c/linux@lemmy.ml

90 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] lemdeggity@lemmy.dbzer0.com 23 points 13 hours ago (2 children)

The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.

I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.

[–] KaninchenSpeed@lemmy.blahaj.zone 4 points 10 hours ago (1 children)

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

[–] eah@programming.dev 3 points 2 hours ago* (last edited 2 hours ago)

Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?

[–] LewdLemon@sh.itjust.works 3 points 13 hours ago

I did read that part, but like you, I haven't been able to independently verify it yet.