Nah, it's the transmission of the keys to Apple or Microsoft. We flatly rejected key escrow during the Clinton Administration, and I continue to reject it. And no, I absolutely do not trust their implementation of E2EE to mean there are no backdoors.
Are you aware that none of that is required when signing up for a site that supports passkeys?
I think there is some confusion here caused by sloppy use of terminology among FAANG and the standards groups. You’re right that, strictly speaking, Apple defined “passkeys” as synced credentials. And you’re also right to point out that, as a result, in order to consider them secure, you must trust Apple’s key storage and E2EE iCloud syncing, or the equivalent from other vendors. I wouldn’t blame you for being skeptical about synced credentials. The convenience may not be worth it for you.
However, crucially, synced credentials are just one type of FIDO2 credential. The other is a hardware-bound key from a “roaming” authenticator (aka a “security key”). These are never transmitted, never synced, and you can buy the security key hardware that generates and stores them from many different vendors, all of which are designed to be interoperable.
In other words, all passkeys are FIDO2, but not all FIDO2 are passkeys. Yet, when a website says it supports passkeys, it probably means it supports all FIDO2. And that’s because WebAuthn, the browser standard used to implement passkey registration and authentication on the web, supports all FIDO2 credentials, not just passkeys.
With WebAuthn (and most other systems), by default both platform authenticators (which would typically be synced, like you’re talking about, but not necessarily) and roaming authenticates (which would be typically be a USB security key, not synced) are allowed. I’ve occasionally stumbled upon sites that don’t allow platform authenticators, but I’ve never come across one that doesn’t allow roaming authenticators. It sounds like you want is the latter.
Apple could have avoided this mess by simply deciding that “passkeys” are the new name for “FIDO2 credentials” and then we could have synced passkeys and non-synced passkeys. But they apparently thought that was too confusing.
The SIR-C/X-SAR was launched in the Shuttle Bay and used to map the entire surface of The Earth. Some would call that a munition. This article, following that event IS the confirmation.
You mean the government that has been kidnapping the neighbors with whom I do have a real "social contract"?
I mean, I don't generally think that it's a very useful contact, but of all the things I've studied in my life, taking a long, hard look at the material history of the US government has done teh most to make me think that social relations and responsibilities have nothing do with formal governance.
They kidnapped and confiscated the phone of a previous coworker of mine who was born here as a US citizen for a week after arresting 7 other people at his workplace. His mom had no idea where he was or if he was safe until he called her a week later asking to help him get home from a detention center 3 states away.
reply