logoalt Hacker News

xg15 • yesterday at 11:14 PM • 2 replies • view on HN

Then why do we need all the stuff about attestation and data bits?


Replies

danpalmer • yesterday at 11:26 PM

Because it prevents an attacker from stealing the password. It's both extremely hard to "steal" a passkey, and to phish a login from one. Neither of those are true for passwords, and TOTP only partially solves the stealing part.

Passkeys aren't solving for security nerds who like portability and have 30 character long passwords, they're solving for grandpa who will happily read their bank's 2FA SMS to the "bank" over the phone. The FIDO alliance has literally billions more of these users than they do users who know what hardware attestation is and how it impacts their auth workflows.

➕ show 1 reply
thadt • yesterday at 11:41 PM

So companies can use passkeys and set policies around what hardware they're stored on. IMHO, not particularly useful or desirable for everyday Internet users, but really nice if you have specific requirements.