The problem is not passkeys in themselves, but the role they might play in making remote attestation ubiquitous. Remote attestation locks in an oligopoly from hardware through operating system, and the operating system vendor can apply any restrictions they want. Remote attestation is already a problem for users of aftermarket operating systems on phones, but not a ubiquitous one because it mostly only affects payment and some banking apps.
Every time passkeys come up, I am roundly assured that attested passkeys are DOA, because starting to require them would force Apple to revoke all of its existing passkeys. But I don’t have confidence that that’s a sufficient deterrent.
The problem is not passkeys in themselves, but the role they might play in making remote attestation ubiquitous. Remote attestation locks in an oligopoly from hardware through operating system, and the operating system vendor can apply any restrictions they want. Remote attestation is already a problem for users of aftermarket operating systems on phones, but not a ubiquitous one because it mostly only affects payment and some banking apps.
Every time passkeys come up, I am roundly assured that attested passkeys are DOA, because starting to require them would force Apple to revoke all of its existing passkeys. But I don’t have confidence that that’s a sufficient deterrent.