lucille

I went out to update my ID in boymode today. There were some administrative trouble with categorisation of documents, and when the clerk that I was talking with got help she referred to me as “This young lady” and I had to try not to melt at the desk. I’m still smiling thinking about it most of the day later.

I think the root cause is probably the current NZ government trying to get reelected. They seem to be starting up their campaigning for next year’s election and they can’t use their previous platform as it would spark discussions that they don’t want to talk about (e.g. the economy and the bootcamps).

It doesn’t help that some media outlets in NZ have been trying to politicize trans people more recently and I think the government saw an opportunity to include it in their campaigning.

It seems like the idea behind having the passkeys synced through cloud platforms is to mitigate the device failure risk as much as possible, as any device logged into the cloud account could be used to access the passkey protected accounts. It seems a little short-sighted as it means that the passkeys are limited to AAL2 (as AAL3 requires it to be non-exportable), and depends on the security of the cloud account. The cloud account can’t use anything as secure as a passkey, as it would reintroduce the device failure risk (meaning that your security has been downgraded from AAL3 to AAL2 for no reason).

It should also be noted that if the cloud account is not phishing-resistant (which it can’t be for reasons stated above), then the accounts protected by passkeys aren’t phishing resistant either, as the cloud account could be phished, which would lead to a compromise of the other accounts.

At AAL2 you could also just use a password and OTP, which doesn’t have the vendor lock-in problems with cloud synced passkeys and has a wider adoption already.

In my opinion there is no need for cloud syncing, as device failure risk is negligible if you have a backup security key (as the failure rate of a single security key is already extremely low).