@rmondello@hachyderm.io I find the
#attestation part of that article is actually fair in some aspects.
Hardware attestation seems fundamentally
#antiuser to me and is typically done via
#closedsource #security theater.
And I'm not the only one:
https://www.gnu.org/philosophy/can-you-trust.html
While
#TOTP is fishable, and the article is weaker for not acknowledging it, I think there is a point to be made that it still is a useful defense against other threat models and has therefore arguably more than zero increased value - whether that makes it "great" or not.
Some of us are of the opinion that if
#passkeys aren't some trusted computing scheme, perhaps hardware
#DRM shouldn't be part of the standard. Beyond at most cheap separate portable hardware key dongles (and even those seem questionable to me as a possibly enforced item). Yet
#TPM attestation is in there:
https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation
I also find the claim that the writer of the article isn't "understanding the topic being discussed" is weakening your points!
Nevertheless, your insight was useful and I appreciate you entering the discussion.
#security #TOTP #passkeys 
