🌕 通行密鑰是一個陷阱，請切勿使用 ➤ 揭開便捷身分認證背後的控制權隱憂 ✤ https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them 各大網站積極推廣「通行密鑰」（Passkeys）來取代傳統密碼，雖然這提升了安全性與便利性，卻讓使用者失去對憑證的最終掌控權。相較於開放且可自由轉移的 TOTP 雙重驗證機制，通行密鑰由 FIDO 聯盟主導，背後涵蓋科技巨頭與政府機構的利益。這類技術透過統一命名掩蓋了限制，逐漸剝奪使用者轉移與備份憑證的自由。
#fido
7 posts · Last used 26d
The FIDO Alliance publishes certificates for "Device attestation" for Passkeys through something called the FIDO Metadata Service(MDS). The idea here is that a service can restrict the use of passkeys to certain vendors. (One can argue whether that's a problematic, user-hostile feature to begin with.)
Looking through the certificates, we find this "interesting" cert:
"CN=FIDO2 Enterprise Attestation BATCH KEY prime256v1, emailAddress=tools@fidoalliance.org, O=FIDO Alliance, OU=Authenticator Attestation, C=US, ST=MY, L=Wakefield"
Its Issuer looks even more interesting:
"CN=FIDO2 Enterprise Attestation TEST ROOT, emailAddress=tools@fidoalliance.org, O=FIDO Alliance, OU=CWG, C=US, ST=CA, L=Mountain View"
It's not the only one in there that implies it's some form of "test" cert. However, this one is particularly interesting, as... it's also, apparently, using a "test" private key, which you can find here:
https://github.com/fido-alliance/conformance-test-tools-resources/blob/main/docs/FIDO2/Authenticator/README.md
In case you want to pretend that you're building a "KQC QuKey Bio FIDO2 Authenticator", that may come in handy.
It's not the only odd issue in that list, there are also plenty of certs with encoding errors. See, e.g.: https://github.com/fido-alliance/fido-device-onboard-feedback/issues/5
(Found together with @duesee@norden.social )
#0day #passkeys #fido
Friends, I need some help and advice.
Microsoft recently announced retirement of Microsoft-provided SMS and voice authentication in Entra ID.
Of course, "good", you say -- me, too. But I'm working with an organization that has some extremely non-techie employees, and I've got to figure out the easiest path to help them get properly on-boarded with Passkeys.
Microsoft Authenticator seems to support Passkeys natively (the key is stored IN MS Authenticator). Is this the best way to do this? My non-techie users are primarily mobile phone users on Exchange Plan 1 (no "fat" client).
Help!
#passkeys #webauthn #fido #microsoft #mfa #lazyweb #help
References:
https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/
https://mc.merill.net/message/MC1426371
Rogers cuts phone shipping fees from $25 to $9 for itself and Fido amid CRTC scrutiny
https://mobilesyrup.com/2026/07/10/rogers-fido-cut-phone-shipping-fee-amid-crtc-scrutiny/
Rogers réduit les frais de livraison de 25$ à 9$ pour soi-même et Fido durant l’enquête du CRTC
// Article en anglais //
The Race Is on to Keep #AI #Agents From Running Wild With Your #CreditCards
#AIagents may soon be buying your stuff for you. The #FIDO Alliance has teamed up with #Google and #Mastercard to try to ensure that #shopping in the near future isn't a complete disaster.
#security
The Race Is on to Keep #AI Agents From Running Wild With Your Credit Cards
https://www.wired.com/story/the-race-is-on-to-keep-ai-agents-from-running-wild-with-your-credit-cards/
#AgenticAI #cybersecurity #shopping #finance #Google #Mastercard #FIDO
I am looking for some #localFirst solution for blog authoring what would publish (all or some) posts to an activityPub server like to a relay, with publishing of new versions of posts as updates.
And fetch new posts, comments, mentions, messages, and reactions arrive to my local-first thing as a Feed or an Inbox.
Sounds like I want "Fido with formatting and attachments" over #ActivityPub .
The #Fido part is avoid need to be "always online", but sync that few times per day when have time for it
You've seen all posts