Tag
A blog post and ensuing discussion argue that passkeys embed FIDO attestation mechanisms that could gradually let websites strip users' control over their credentials, while Apple's Ricky Mondello rebuts that attestation is explicitly not designed for mass-market consumer authentication.
Scott Helme 推翻了《Passkeys Are a Trap》一文的论点，解释了同步式 passkey 并不会向网站提供证明信息（attestation），且证明机制并不会暴露操作系统或浏览器信息，TOTP 反而是更容易被钓鱼的倒退方案。
This paper presents Canonical Action Verification and Attestation (CAVA), a runtime-semantics layer that converts heterogeneous agent activity into canonical runtime action objects for governance, enabling consistent approval binding, receipt reproducibility, and policy enforcement across diverse AI execution environments.
The article discusses the concept of verifiable AI inference, exploring methods like trusted attestation and cryptographic proofs to ensure the authenticity and provenance of AI-generated outputs without rerunning the model.
The article explains how a single XSS vulnerability can defeat the phishing-resistance of passkeys when attestation is set to 'none', allowing attackers to register their own passkeys and achieve persistent account takeover. It calls for attention to this overlooked threat and suggests defenses.
A deterministic action-level attestation architecture for AI mediation was developed and validated in discussions with Microsoft's engineering team. The author seeks investors or partners for the software architecture.