11–20 of 357 posts
If you look at the APIs available on MacOS/iOS at present [0], and how WebAuthn works, you need to "trust" the client-side software to correctly identify the site origin (i.e. protocol, domain, port) and pass it to a physical security key. In the case of a software token, you need to restrict which app(s) can pass this information through to the system carrying out authentication.
The end result right now, as I can see it, is that if you sign up to a website using a "passkey" via Safari (for example), there is no real supported workflow that isn't site-specific, for migrating to a new browser - you are effectively beholden to Apple's keychain for getting you back into that site.
If you want to enrol a new device (say an Android phone using its own software implementation of WebAuthn), you would need to find a way to sign into your old account (which requires your MacOS/iOS passkey to log in), then enrol your Android device (which is a separate physical device). You'll likely get stuck here.
An expert user could add a physical FIDO2 token to their account from the old device (Safari), and use that as the authenticator to log in on the new device, but this is significant friction for a non-technical user.
While moving users away from passwords might make sense, I do think we'll see these "passwordless" authentication mechanisms become the next major point of friction in user browser choice. Even if you can implement WebAuthn in your rival browser, unless you get access to the system key store, you won't be able to let users sign in. That will prevent them switching.
[0] https://developer.apple.com/documentation/xcode/supporting-a...
Why wouldn't Msoft NOT force Edge as the default browser; a company could fill their coffers hugely if they had a lot of browser market share.
It drives me nuts that a fresh install of Android apps defaults them all to "in-app" browsing instead of my default browser. And you have to go to each app and turn it off in a different place. Wish I could just override all of them and "open every web page in My. Default. Browser. "
Microsoft started spending dramatically more money on "lobbying" following that.
[1] - https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....
They're right, recently I've installed some Windows update for my parents and I had to reject like 5 suggested changes - installing Office trial, switching default browser to Edge yet again, and more. But this goes way beyond the browsers - I've never explicitly installed Keychain on my iphone and yet it shows as an option next to 1password every time I fill in a password field. Google calendar asks me to install an…
[ ] Show me the Windows welcome experience after updates ...
[ ] Suggest ways I can finish setting up my device ...
[ ] Get tips, tricks, ...
...and so did Mozilla, when FirefoxOS was a thing. Gecko is still the default engine for KaiOS. Are we in browser-whining season again? (Typing this from Firefox on macOS.)
Without commenting on the claims, it's interesting to consider how times have changed. Microsoft originally lost an antitrust lawsuit [1] over little more than tying Internet Explorer into their OS and not readily including alternatives. They not only lost that case, but the initial judgement was that the company was to be broken up. Microsoft started spending dramatically more money on "lobbying" following that. [1]…
Facebook acquired and repeatedly copied its closest competitors, no problem. Adobe buys up its competitors, no problem. Google aggressively pushes Chrome and fails to makes its own websites fully compatible with competitors, carry on. Apple refuses to give users the freedom to run their own apps on their purchased phones, no biggie.
Was there some kind of official policy shift, or did the government just give up?
One of the next frontiers as a barrier to browser switching will be "software"-backed WebAuthn/FIDO2/"passkeys". If you look at the APIs available on MacOS/iOS at present [0], and how WebAuthn works, you need to "trust" the client-side software to correctly identify the site origin (i.e. protocol, domain, port) and pass it to a physical security key. In the case of a software token, you need to restrict which app(s)…