this post was submitted on 14 Oct 2026
132 points (75.0% liked)
Privacy
51480 readers
275 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
A good start would be to not bundle into the protocol a method explicitly intended for services to be able to securely identify what local software (or hardware) you used with the explicit purpose of allowing the service to be able to reject access if that client software (or hardware) is not allowlisted.
Passkeys is a great idea. But the "Attestation" part of the protocol ...not so much.
Is this with the intention of excluding bots?
This has nothing to do with what we're talking about.
It may make it somewhat harder, but I wouldn't say it makes bots impossible (eg. device farms).
But I agree botting has nothing to do with what we are talking about.
We are talking about "capturing" the user and I'm saying the protocol has built-in a method for services to require the users to use only the authentication methods the service allows.
The attestation certificate includes metadata securely identifying the exact maker, model, and capabilities of the local authenticator you used, with the purpose of allowing services to verify if they trust the authenticator.
So if you use your own no-name open source fork of a particular authenticator and don’t even register it with the FIDO Alliance Metadata Service then services requiring attestation would reject your keys (unless they explicitly make the exception for your particular AAGUID... but at that point why ask for attestation in the first place?).
You have a very strange way of communicating but I see your point.