I don't find this post convincing.

> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for years now.

This isn't a rebuttal to the claim that they're a hidden dial. It's just saying that it's too early to crank the dial.

>Attestation Isn't What You Think It Is

>The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.

>When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

This point is bypassed by websites only supporting specific authenticators and then those specific authenticators only supporting specific devices/OSs/browsers/etc via other attestation frameworks.

▲

flumpcakes 2 hours ago | parent [-]

Then guess what - people stop using those websites.

The big players who want to gatekeep you in their ecosystem do not want attestation - they want you to give them your passkeys for them to store under the guise of "hey, we'll sync it for you!".

A yubikey is easy to use. Buy a second as back-up. If you're clumsy and lose things all the time then set up recovery codes. Add a recovery contact. Use insecure 2fa like TOTP or really insecure 2fa like email/sms/etc. codes.

There's plenty of options for authentication in the modern world and passkeys are at the top. If users are 'too stupid' to use them then that's a user problem.

I'd rather spend the 5 minutes reading how these things work and then not hand the keys over to big tech.

	▲	goda90 2 hours ago \| parent \| next [-]
		Only a few people stop using those websites, because most people will use the Apple or Google authenticators and be done with it. And if those websites are essential services, those few people who don't conform will be left out in significant ways.
	▲	zootboy 2 hours ago \| parent \| prev \| next [-]
		> Then guess what - people stop using those websites. Wishful thinking. Sadly, the vast majority of people will be perfectly OK with a website telling them they have to use a recent iPhone or Play-enabled Android phone to do something. This is already the case for banking apps and a huge number of other phone-app-only services.
	▲	xigoi an hour ago \| parent \| prev [-]
		> Then guess what - people stop using those websites. You can’t just stop using those websites if your university uses them for student/employee accounts.