一位分析人士对Passkeys技术提出了安全隐忧。虽然Passkeys作为密码替代方案在表面上提供了便利性和安全性，但FIDO Alliance通过远程证明等机制为网站和科技公司赋予了逐步限制用户选择权的能力1。FIDO Alliance的成员包括大型科技公司、政府部门、情报机构和银行，但不包含消费者权益保护组织1。
Passkeys存在16种不同的基本组合变体，加上WebAuthn Level 3后功能更多，还预留了两个标志位供未来使用1。远程证明机制使网站能够验证用户是否使用经批准的Passkey管理器，并可以拒绝非证明的Passkeys或来自运行自定义操作系统（如LineageOS）设备的登录请求1。这些机制最终可能被用于限制用户运行未经批准的软件和操作系统1。
分析人士建议使用TOTP（基于时间的一次性密码）或YubiKey等物理安全密钥作为替代方案1。
A technology analyst has raised significant concerns about passkeys as a password replacement, arguing that while they appear to offer convenience and security benefits, they enable tech companies and websites to progressively restrict user autonomy through verification mechanisms 1.
The FIDO Alliance, whose membership includes major technology firms, government agencies, intelligence services, and financial institutions—but notably excludes consumer protection organizations—backs passkey technology 1. Passkeys exist in at least 16 different basic configuration combinations, with even more possibilities introduced by WebAuthn Level 3 standards and two reserved flag positions for future expansion 1. The critic highlights remote attestation as a particularly problematic feature, which allows websites to verify whether users are employing approved passkey managers and reject logins from devices running custom operating systems such as LineageOS or those using non-attested passkeys 1.
Rather than adopting passkeys, the analyst recommends users consider Time-Based One-Time Passwords (TOTP) or physical security keys like YubiKeys as safer alternatives 1. The concern centers on how these mechanisms could eventually be leveraged to prevent users from running unapproved software and operating systems, fundamentally altering control over personal devices 1.
评论
还没有评论，欢迎留下第一条。