And still no response here: https://lore.kernel.org/lkml/[email protected]/T/

I wonder when somebody’s going to fork the Linux Kernel based on a pre slop version.

Oh I know I have a TPM, yes. I blacklist all the Linux TPM modules though. Screw that thing.

This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)

Like, yeah, GNU/FSF tend to be radical with many opinions and that’s not everyone’s cup of tea. But I feel like this article has a point.

But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.

I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device “TPM”: https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker …in regular customer machines.

Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.

While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.

Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.

Anyway, that’s just my opinion.

People upvote because they hate change.

People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.

One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.

I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.

If it was just to helpfully reduce friction, it wouldn’t be so controversial. The inclusion of any sort of TPM and hardware attestation support at all is what has some people sounding the alarm (in my opinion rightfully).

Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)