I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device “TPM”: https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker …in regular customer machines.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
Oh I know I have a TPM, yes. I blacklist all the Linux TPM modules though. Screw that thing.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.