I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.
Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.
Basically it boils down to “trust us, we won’t do what this guy is warning you we might do”
Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.
There was a member of the FIDO Consortium in a Keepass PR comment section implying that they would blacklist Keepass as a "responsible party" if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.
These bodies need industry involvement/support (I've worked in similar WGs at both Red Hat and Microsoft), but it's very easy to engage in behavior that could easily be ladder-pulling.
What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.
I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.
Ricky Mondello is a principal software engineer at Apple, on the Authentication Experience team, and responsible for the Passwords app and developing the roadmap for passkeys.
Not a great rebuttal.
I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.
Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.
Basically it boils down to “trust us, we won’t do what this guy is warning you we might do”
Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.
No, the post in question just has really poor reasoning, and this one rightfully calls that out.
There was a member of the FIDO Consortium in a Keepass PR comment section implying that they would blacklist Keepass as a "responsible party" if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.
These bodies need industry involvement/support (I've worked in similar WGs at both Red Hat and Microsoft), but it's very easy to engage in behavior that could easily be ladder-pulling.
>if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.
This is factually incorrect — no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple: https://support.apple.com/guide/iphone/share-passwords-iphe6...
What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.
I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.
https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20240522.html
Fast forward to today... and it looks like there's movement towards doing exactly that:
https://github.com/keepassxreboot/keepassxc/pull/13343
--
Edit: Indeed if you scroll down to the last comment on that infamous PR (https://github.com/keepassxreboot/keepassxc/issues/10407#iss...), you'll see they closed it in favor of implementing the Credentials Exchange standard.
Can you link to that comment ? That's pretty wild.
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
Ricky Mondello is a principal software engineer at Apple, on the Authentication Experience team, and responsible for the Passwords app and developing the roadmap for passkeys.
https://rmondello.com/rmondello-résumé.pdf
Great rebuttal.