this post was submitted on 14 Oct 2026
349 points (97.5% liked)
Linux
68115 readers
1257 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it's not a problem, but how can we know it won't be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
The web api for fido2/passkeys exposes attestation information.
from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?
I did read that part, but like you, I haven't been able to independently verify it yet.
Until they only allow specific AAGUIDs to enroll passkeys that don't include the one used by KeePassXC (
fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don't consider them secure enough.https://aaguid.nicolasuter.ch/
For now.
In some countries, banks require users use their app on IOS or Google'd Android. You can't use their services via browser, LineageOS, GrapheneOS
True. I'm kind of affected by this in GOS, although I found a workaround to bludgeon my banking app into submission.
Still, this is an issue that is already here, and it exists independently of passkeys.
Then you're screwed anyway
This mentality is so gross. "Well might as well roll over and get pounded in the A by big corpo! what else am I going to do, right? Hehe!"
So what are you gonna do about i
Me personally, I'd get a burner smartphone in a drawer just for banking that is on airplane mode 24/7 except when I need it for banking and use a dumbphone for everything else. Also, I run linux and I have strict control over my router and I have ZERO subscriptions and creditcards. It's not much but it's something. Beats blindly rimming apple and alphabet.
Good work. Never capitulate.
That's not gonna stop them from doing any of these things you're afraid of it's just sparing you from it
A better tomorrow starts with YOU.
Fuck off with that defeatist bullshit.
Make them drag you ckicking and screaming. Only morons and cowards walk in lock-step with the corpos
Then don't use these websites and this is a non issue
Ah, but of course! Why didn't I think of closing my bank account?
Which most people don't do.
They'll learn like I did the hard way. Lol