Replying to
@rmondello@hachyderm.io I find the #attestation part of that article is actually fair in some aspects.
Hardware attestation seems fundamentally #antiuser to me and is typically done via #closedsource #security theater.
And I'm not the only one: https://www.gnu.org/philosophy/can-you-trust.html
While #TOTP is fishable, and the article is weaker for not acknowledging it, I think there is a point to be made that it still is a useful defense against other threat models and has therefore arguably more than zero increased value - whether that makes it "great" or not.
Some of us are of the opinion that if #passkeys aren't some trusted computing scheme, perhaps hardware #DRM shouldn't be part of the standard. Beyond at most cheap separate portable hardware key dongles (and even those seem questionable to me as a possibly enforced item). Yet #TPM attestation is in there: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation
I also find the claim that the writer of the article isn't "understanding the topic being discussed" is weakening your points!
Nevertheless, your insight was useful and I appreciate you entering the discussion.
#security #TOTP #passkeys
