[Dagonfly]

Quoting your comments on github [0]

>> There is no passkey certification process

> This is currently being defined and is almost complete.

>> no signed stamp of approval from on high

> see above. Once certification and attestation goes live, there will be a minimum functional and security bar for providers.

Will I always be able to use any credential manager of my choice? Any naturally also includes software that I might have written myself. And would you be in support of an ecosystem where RPs might block my implementation based on my AAGUID?

[0] https://github.com/keepassxreboot/keepassxc/issues/10406#iss...

[timmyc123]

Unclear how this quoted comment relates to what I was replying to (which was about exporting / backing up your credentials).

But I'll respond.

> Will I always be able to use any credential manager of my choice? Any naturally also includes software that I might have written myself. And would you be in support of an ecosystem where RPs might block my implementation based on my AAGUID?

If a website were to block your custom software's AAGUID for some reason, you can change your AAGUID.

AAGUIDs in the consumer passkey ecosystem are used to name your credential manager in account settings so you remember where you saved your passkey.

[Dagonfly]

Well it relates to this sentence:

> You can use any credential manager you choose.

Which I would be careful with. I can use any authenticator that the RP accepts. I could totally see a future where banks only allow certain authenticators (Apple/Google) and enforce this through AAGUID or even attStmt. Similar to the Google Play Protect situation.

At that point, those banks/services would enforce vendor lock-in on me. The reality would be: I can use iOS or Android, but not a FOSS implementation. This restriction is not possible with old-school passwords.