alt Hacker NewsThen guess what - people stop using those websites.
The big players who want to gatekeep you in their ecosystem do not want attestation - they want you to give them your passkeys for them to store under the guise of "hey, we'll sync it for you!".
A yubikey is easy to use. Buy a second as back-up. If you're clumsy and lose things all the time then set up recovery codes. Add a recovery contact. Use insecure 2fa like TOTP or really insecure 2fa like email/sms/etc. codes.
There's plenty of options for authentication in the modern world and passkeys are at the top. If users are 'too stupid' to use them then that's a user problem.
I'd rather spend the 5 minutes reading how these things work and then not hand the keys over to big tech.
Replies
> Then guess what - people stop using those websites.
Wishful thinking. Sadly, the vast majority of people will be perfectly OK with a website telling them they have to use a recent iPhone or Play-enabled Android phone to do something. This is already the case for banking apps and a huge number of other phone-app-only services.
> Then guess what - people stop using those websites.
You can’t just stop using those websites if your university uses them for student/employee accounts.
Only a few people stop using those websites, because most people will use the Apple or Google authenticators and be done with it. And if those websites are essential services, those few people who don't conform will be left out in significant ways.