Ricky Mondello responds to "Passkeys are a trap. Do not use them."

latexr

Ricky Mondello is a principal software engineer at Apple, on the Authentication Experience team, and responsible for the Passwords app and developing the roadmap for passkeys. https://rmondello.com/rmondello-résumé.pdf

toomuchtodo

Great rebuttal.

dmitrygr

Basically it boils down to “trust us, we won’t do what this guy is warning you we might do” Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.

rstuart4133

Not a great rebuttal. I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor. Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.

JamesLeonis

> The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. Windows 11 rolled out with a required minimum TPM 2.0 as a way to force upgrade hardware, including threatening security updates. HN talked about it for weeks. It caused a mass exodus from Windows to SteamOS for many gamers. While I agree this isn't a conspiracy, it is an open secret that these companies on the Alliance historically make and use standards to their own gain and against their users. It is the same with citizens relationship with governments, which comes with a long history of brutal repressions by the very agencies on the Alliance. This comes especially under the microscope when those tech companies collude with those Agencies against domestic citizens. The trust is not there. What's funny is that Passkeys are running into the OIDC problem again where everybody and their dog wants you to use their own implementation. The Costco app keeps bugging me to set up a passkey, and comments on the other HN thread have more examples [0]. It's just a mess. It's ironic the little inter-company territorial spats that keep the big conspiracies at bay. On the other hand, I'm helping more people around me onboard into password managers. The number of accounts people have to juggle nowadays makes this a security mess too. Having one centralized place where all the accounts are stored (and backed up) is often a bigger boon for people than the secure passwords! [0]: https://news.ycombinator.com/item?id=50048775