6 ms·
Hi, Tim Cappalli here. Not sure how stating that my (an individual) opinions on a topic are evolving is interpreted as "threatened the KeypassXC developers".
by timmyc123 9mo ago
Hi, Tim Cappalli here.
Not sure how stating that my (an individual) opinions on a topic are evolving is interpreted as "threatened the KeypassXC developers".
If you've been following along, you'll have seen that I am actually one of the biggest advocates of the open passkey ecosystem, and have been working really hard to make sure all credential managers have a level playing field.
Always happy to chat directly if you have concerns!
- pseudalopex 9mo agoThe threat you relayed was more serious than the threat you made. But it is a threat when a person with influence suggests they may support a punishment. The biggest advocates of an open ecosystem say attestation should be removed and no one should adopt Passkeys before. Is this your position now? The concerns were clear I thought. I would be happy to discuss this publicly.
- timmyc123 9mo agoAttestation is not used in the consumer passkey ecosystem.
- pseudalopex 9mo agoBut it could be. Yes?
- timmyc123 9mo agoNot really. The attestation model defined for workforce (enterprise) credential managers/authenticators doesn't really work in practice for consumer credential managers.
- pseudalopex 9mo ago> doesn't really work in practice Avoid weasel words please. Is it possible in theory to use attestation or any other Passkeys feature ever to prevent a user to use any software they chose with any service they chose?
- jesseendahl 9mo agoIn theory any code could be written at any time that does something good or bad. Sure. But in reality, the people who actually work on these standards within the FIDO alliance do not want a world where every website/service makes arbitrary decisions on which password managers are allowed. That would be a nightmare.
- deltoidmaximus 9mo agoWill be a nightmare. If they really didn't want this they wouldn't have put the tool to do it right in the spec.