• 0 Posts
  • 15 Comments
Joined 4 months ago
cake
Cake day: July 2nd, 2026

help-circle





  • The argument from the “it’s a trap” article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.

    I have to admit that I haven’t investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.



  • It’s essentially just public key cryptography streamlined to reduce friction for the user. When you’re prompted to create a passkey for a service a new public/private keypair is created. The private key can then be synced to other devices for example via the iCloud keychain or Bitwarden. Obviously you have to then trust that provider to keep your keys safe. The upside is that your passkey can be automatically discovered and used to sign in without using a password. Alternatively the private key can be device bound but the downside is that if you lose the device you lose the private key too.








  • I think you’re jumping the gun a bit. They’re just saying that requiring a phone number added a barrier against spammers and they want to be sure this change doesn’t open the flood gates.

    From the article:

    "We gotta figure out some way to induce a cost for signing up without a phone number”, Kret said.

    It’s unclear whether this means that registration without a phone number will become a paid feature.

    However, “cost” does not necessarily mean a monetary fee; it could also refer to another barrier designed to prevent abuse.