Post

I think all the fuckups of webauthn can be traced back to the fact that the underlying protocol is very simple and therefore enables a wide ecosystem of authenticators, but the companies that brought it to the web wanted to have absolute control over what authenticators users use.

jenn da joker@jennschiffer.com

passkey is imho one of the most important security developments that touch consumers and also one of the worst consumer rollouts i ever witnessed because every company involved treats everything like an enterprise customer solution

20/4/26, 10:12 am1 repost8 likes

snek

@snek.dev

20 Apr

passkeys vs security keys, all these different uis users see depending on what obscure json parameters you set, etc etc etc. all complexity bolted on top of an otherwise simple system so that users are pushed into using google vault/apple icloud/etc.

snek

@snek.dev

20 Apr

when we shipped webauthn at discord we hit multiple places where e.g. chrome browser on desktop would allow a user to register, and then android would not allow that same authenticator to be used to sign in, because it interpreted the request differently and showed a different ui.

snek

@snek.dev

20 Apr

and when we talked to the people in charge of these platforms they simply did not care. our goal of allowing users to just use whatever ctap devices they want to use was explicitly not part of their product goals.