649
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 28 Feb 2026
649 points (95.9% liked)
Privacy
48758 readers
461 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
I'm not seeing anything that's not a great look about requiring strong authentication for access to sensitive portions of a users account. What you're saying is akin to calling it a bad look that they force users to use complex passwords against user wishes.
I'm not sure what "trust me bro, my cloud is safe" has to do with anything. Passkeys live on your device. There are ways of facilitating device to device migrations of the keys if you want. You don't need to use them to use passkeys. And at least on Android you don't need to even use Google to manage the keys.
Most semiconductors are closed source. The processor, ram, and radio are also more than likely closed. The software interfaces to all of them have open specification and implementation. There's like, six for Linux. Microsoft open sourced theirs.
Tpms are not security through obscurity. They are obscure, but that's not a critical component to their security model.
What they do isn't really what "collecting biometrics" implies. They're storing key points in a hashed fashion that allows similarities to be compared. Even if it wasn't encrypted in a non-exportable way you still can't do anything with it beyond checking for a similarity score.
You've done a good job explaining what I said previously: there's sometimes a disjoint between privacy and security concern, and so sometimes people don't understand something about security.
I wasn't arguing against Passkeys, just pointing out how they are often perceived.
I was definitely arguing against TPMs, however. https://gist.github.com/osy/45e612345376a65c56d0678834535166 https://pluralistic.net/2024/01/18/descartes-delenda-est/#self-destruct-sequence-initiated https://www.elevenforum.com/t/tpm-2-0-is-a-must-they-said-it-will-improve-windows-security-they-said.13222/ https://scispace.com/pdf/tpm-2-0-uefi-and-their-impact-on-security-and-users-freedom-2e1ldhodqq.pdf https://www.gnu.org/philosophy/can-you-trust.en.html (But Passkeys apparently don't need them, see my KeepassXC mention before.)
Just so you know, from looking at the wall of text you pasted by proxy: those are arguments against the notion that a tpm can make the device itself secure, not that it is untrustworthy for the notion of signing and storing encrypted data.
Next time, make your point and provide references (or not), rather than just link bombing.
I provide whatever I think is useful for the discussion.
And I'm just letting you know that link bombing isn't, and it's actually a discussion if you explain your point rather than dropping someone else's novel.
If for no other reason than because you don't have to dig for what part of what was posted is related to what they were saying, and you can much faster say "ah, you're talking about something totally different than I am".
I don't think you're making a relevant point, but I'm not interested in continuing. Sorry for the terseness, I just don't want to drag this on.
Nah, it's cool. We're clearly talking at cross purposes. Have a good one.