https://en.wiktionary.org/wiki/-sis

The corporate.

> I believe the goal is to know which registered (ie explicitly approved) device a login is coming from.

They can do that with non-transferrable passkeys already (assuming they hand out the devices, and trust the manufacturer to actually prevent transferring the keys out). No cosigning required here.

It is a problem, but isn’t FIDO acting as this body already wrt attestation in WebAuthn? I’m only building on top of this existing process.

Regardless, a sibling commenter has a good idea of how to sidestep this in corporate environment, and I think it should work for most of actually useful purposes.

> I think shunning attestation is largely the right move

I’m glad we’re on the same page :-) But as long as we have attestation for passkeys, I think we should at least make it as hard as humanly possible to (ab)use it as a general device attestation scheme.

...get it certified, then transfer the keys to it. Or more likely you get an HSM and use its certification.

> I don't think consumer oriented protocols should support it.

Ideally yeah, that’s my point of view as well. In the corporate land however...

> binding credentials to some subset of physical devices

I don’t think that’s the goal. My guess is, they want to be able to transfer some passkeys but not allow any copies, and this only works if one device trusts another. It could work still with your scheme (store a private key on each device; when transferring a secret, make one device encrypt it to the other and immediately destroy its own copy, and make IT department sign any transfer requests so they can check whether they own both devices).

> Apple used to support attestation but removed it. That alone makes it non-viable for sites to enforce attestation.

Again, for now. Apple might have less incentives to bring it back than Google, sure, but their products are not really known for being open platforms either.

I haven’t checked, but I suppose both Google and Apple have passkeys implementations capable of attestation? (If not, it should be fairly easy to add, and considering Google has been pushing for various “integrity” bullshit, this would be a no-brainer for them.)

> They can't, because open/neutral access secure elements do not exist yet, and nobody really wants to carry an external one.

I’m not 100% sure if this would work: https://developer.android.com/privacy-and-security/security-...

Presumably, banks trust Google, so if Android doesn’t erase attestation information from the HSM when unlocking the bootloader, they could use this process to verify that the key they’ve generated is stored there, regardless of whatever other software the user is running. (If Android does erase attestation info then eh, it’s just as bad as relying on Play Integrity APIs.)

It’s dead so far. Again, X.com could ask you to re-enroll your passkey next time you sign in, but this time requiring attestation. It’ll be phrased like “we’re upgrading your account security, please click ‘Accept’ to proceed”.

> banks could require [...a] signature of some sandboxed secure element that runs independently from the application OS

They can. Why don’t they?

I’d say that this is how every country should be. Unfortunately, there is no self-determination in Russia. Yeah, most people do support Putin, though it’s not as overwhelming as they would like you to believe, so they rig the elections. The problem is there’s no real alternative. There like four parties, only one of which does something other than show up and vote for whatever bullshit new law they’re trying to pass, and they’ve invented some new ones recently, which I believe are also all puppets with different branding.

There is also nationalism, of course, feeded by a metric shit ton of propaganda. Will it help keep Russia from breaking up? I don’t know. As a Russian, it’s not up to me, and honestly, I don’t really care about the borders at all. My nationalism does not extend to the state terrorizing my people.

Frankly, the best way to approach it is probably leaving Königsberg / Kaliningrad be as its own state [1] for a bit, and do whatever EU integration programs do. If it works out, you’ll get a million Königsbergers who are a bit nostalgic about Russia but want nothing to do with it otherwise.

One final thing I’d like to note is that the “alien passport” approach taken by the Baltic states mostly, well, alienates the titular nation and Russians right now. If the path to integration was more clear and Russians born and raised in, say, Latvia didn’t feel like second-hand citizens, they wouldn’t really want to have closer ties with Russia either.

[1]: disclaimer for the эшник reading this: this is in a hypothetical scenario where Kaliningrad does get separated from Russia as a result of the “special military operation”. please don’t hurt my family

> I always get a bit nervous when someone tells me that in their country, you can press the elevator button again to unset it.

The way I’ve seen this solved in a lot of countries across SEA is that you unset the elevator button by double-pressing it. It’s not intuitive, and I’ve only discovered it by accident, but it’s deterministic and idempotent: one gesture sets the button, the other unsets it.

[1]: https://unsung.aresluna.org/deterministic-vs-idempotent/

> On a Mac, in simple input fields, ↑ and ↓ jumps to the beginning and end [...] Windows doesn’t have this convention

IIRC it worked for me on Windows (and Linux :-) as well!

I do prefer ⌘←→ as it’s more consistent. Also, ⌥←→ jumps one word back/forward on Mac, the Windows equivalient being ⌃←→.

> On Windows, [refresh is] typically F5, although some browsers now support Ctrl+R, too

Have always supported as far as I can remember :) F5 works on Mac in Firefox (and I think Chromium), but not in Safari.

> On both platforms, Fn+↑↓ does PgUp/ PgDn, and Fn+←→ does Home/End.

This will vary a lot depending on the manufacturer. ThinkPad T420 and other models from that era use those for media keys (which makes sense, they do have physical Home/End/PgUp/Dn keys).

---

Finally, a suggestion to fellow Linux users: try Mac keybindings, it’s amazing (especially if you’re e.g. running Asahi on a Macbook). Not all apps will be happy about this, but at least the KDE ones will generally follow the keybindings you set in the system settings.