The authors concern is primarily about attested and user-verified passkeys.

  • chgxvjh [comrade/them, he/him]@hexbear.netOP
    link
    fedilink
    English
    arrow-up
    7
    ·
    11 hours ago

    The conspiratorial angle is also kinda strange: https://commission.europa.eu/topics/digital-economy-and-society/european-digital-identity_en A digital ID with identifiable PII that the surveillance capital state can abuse via central management and is associated with every transaction is the desired end-state for capital and other wielders of power.

    What now? Is it strange or is it entirely expected?

    • doubledealer [none/use name]@hexbear.net
      link
      fedilink
      English
      arrow-up
      5
      ·
      10 hours ago

      Specifically the conspiracy theory that passkeys are some kind of backdoor is strange to me:

      For intelligence agencies, and for corporations like Microsoft, Google, Apple, Facebook, Amazon – giving you convenience and security is likely not their primary goal. I think they have an entirely ulterior motive. They can use passkeys to prevent you from running unapproved software.

      And:

      I’m not one to argue about slippery slopes, so I won’t claim that the campaigns to protect children online today will tomorrow turn into laws designed to make it easy to identify political dissidents. But I will say that the widespread adoption of the passkey technology being advertised to you as convenient and secure is capable of permitting such laws to be easily enforced.

      The ulterior motives are really around cost of managing credentials and having better assurance that a user is who they claim to be. Instead of paying to have a help desk or a password reset service they can offset the cost to you to have the necessary computing modules or hardware keys to authenticate. Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse. And there are better and more effective means to achieve the other ends the author is worried about, like having a monopoly on 96% of web browsers or killing the market for PCs.

      • PorkrollPosadist [he/him, they/them]@hexbear.net
        link
        fedilink
        English
        arrow-up
        9
        ·
        8 hours ago

        Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse.

        These are literally the same thing. Digital ID is a policy, passkeys are a mechanism. By combining them, you implement a digital ID policy. I grant you that the implementation of a digital ID policy doesn’t necessarily need to use this technology, nor does this technology lack other useful purposes, but we live under the regime of technological capitalism, where innovation is driven purely in the pursuit of maximizing profit and consolidating power.

        The author is fully justified in being suspicious of the motivations of such an infamous coalition including the likes of Apple, Google, Microsoft, Meta, American Express, MasterCard, Bank of America, Wells Fargo, JP Morgan Chase, HSBC, Softbank, Binance, and Coinbase, among others. This is a substantial confluence of Wall Street finance, Silicon Valley venture capital, and every tech company large and small who is lined up to sell shovels in the gold rush of a pending transformation of digital power relations. The threat should be taken seriously, at least.

        None of these firms are concerned with our best interests. By now we should assume any implementation which leaves room to further encroach on individual autonomy is a deliberate strategy.