Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

I think the other reply here might be missing something because while I have not read the whitepaper, the announcement touts these two benefits of deeper FIDO commitment:

> 1. Allow users to automatically access their FIDO sign-in credentials (referred to by some as a “passkey”) on many of their devices, even new ones, without having to re-enroll every account.

> 2. Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.

Point number 2 directly invokes cross-device, cross-platform authentication. It sounds like "you can use your iPhone or Android to sign into a website on your Windows PC" to me. Whether passkeys might actually sync between iCloud keychain and whatever Microsoft offers seems unclear but much less likely

Yet Google, one of the key participants in the FIDO alliance, has published an open source firmware!

I agree the potential exists, in a hypothetical sense. But the dynamics are very different than you describe (with your analogy to the CA ecosystem, which, ironically, gives big platform owners far more power—yet has no evidence of such abuse!).

Right now, there is just not that much use of WebAuthn and FIDO. You’re the guy saying, “if we find a way to lower global temperatures, we should fear an ice age.” It’s premature to say the least.

I'm glad Google has published an open source firmware, and I hope that people will be able to independently verify that the hardware they use is genuinely running that firmware. Then I hope that hardware with such guarantees is not discriminated against by RPs.

The important difference with the CA ecosystem is that (in the worst case) the big platform owners can put pressure on small websites to obtain a certificate from one of a large number of competing issuers. Significantly, these issuers are not the same as the big OS providers themselves, and there are issuers who issue certificates for free. That is completely the reverse of 3 big platforms forcing end users to buy hardware, and those platforms being hardware vendors themselves.

> You’re the guy saying, “if we find a way to lower global temperatures, we should fear an ice age.”

No, I'm the frog saying "Hey, isn't this water getting a bit warm? Don't you think we should jump out before it's too late?"

This problem is already well solved and deployed to millions of people. That it is my point.

To your dicekeys example, a much better solution, IMO is using bip39-diceware which allows you to roll for 256 bits of entropy in the form of 24 BIP39 words with dice, using only a paper worksheet. You can use these with a KDF to determinstically generate any type of key material be it for PGP, FIDO2, mutual TLS, or whatever you like.

BIP39 is a general purpose innovation in human friendly cryptography, and so are the general purpose personal HSM devices that support it.

I don't feel it is productive to balk at a generally useful technology just because one dislikes the biggest audience creating demand for it.

Someone can have a religious objection to porn and still enjoy the bandwidth growth and other improvements to the internet that porn demand helped create.

Just because a toaster is marketed for toast, does not mean you can't enjoy it for pop tarts. Just because a pressure cooker has a "chicken" button, dosen't make it any less useful to a vegan.

The examples are endless.

Those that are fundamentally against experiments in decentalizated governance should at least try to appreciate that space presents high stakes security problems that engineers will innovate to solve.

Many of the best cryptographers in the world, like Dan Boneh and team at Stanford, spend a huge amount of their time focusing on innovations in privacy, computational effenciency, and cryptography to meet demand created by popular decentralized systems experiments.

If anything, buy products like hardware wallets that improve security for you and recommend their teams spin up marketing and product development approaches more inclusive of customers that have moral objections to decentralized governance and value storage use cases like yourself.

Okay, so first of all, you know very well that "moral objections to decentralized governance" is not the problem people have with blockchain technology.

But beside that, perhaps I didn't quite make the point of my comment clear enough. You're trying really hard to convince me of things. I know very well how this works, and what problems it solves, and I do think it's a good solution to this problem.

The main reason I'm not going to buy one of these isn't anything about the technology; it's because I already have a solution for myself and I have no reason to bother switching to another solution.

This isn't about my opinions. I'm explaining why the general public is going to continue to ignore this otherwise valid solution. The marketing around it actively ties it to a thing that most people have negative opinions of, and makes the feature they actually want seem like an afterthought. Even here, you repeatedly refer to it as a hardware wallet, because that has always been the primary focus of those devices.

The effect of this is that the average non-blockchain-person just sees you posting a lot of comments in a tangentially related thread trying to sell them on blockchain tech. Do you see why this, from the perspective of a non-blockchain-person, is counterproductive?

You will continue to have trouble getting people to adopt these devices until either the marketing focus changes or public opinion on blockchains changes. And one of those is going to be much easier to accomplish than the other.

I am not telling you this to bash blockchains. I do have negative opinions on that space, but I don't care to debate them here; nothing would be accomplished by either of us by doing so. I am giving you advice on the way your message is perceived by others.