alt Hacker NewsThats because the people behind passkeys are paternalistic and don't trust users. I had an argument with one of them a few months ago.
https://github.com/keepassxreboot/keepassxc/issues/10407
https://news.ycombinator.com/item?id=47189749#47193048
My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phishing and being called "insecure" and don't care about anything else. Hence why WebAuthn has additional weird anti features like AAGUID for provider authentication.
Another one of those ridiculous threads is saying you gotta have support for nonsense like user presence verification.
> Thats because the people behind passkeys are paternalistic and don't trust users.
To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.