The author is really missing the forest for the trees here

> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

So if I was Netflix or a bank or w/ever I'd only allow new registrations from "trusted" authenticators, which would incidentally only run on iOS and play-protected Android.

▲

linkregister 2 hours ago | parent [-]

The next paragraph states that Yubikeys are a registered authenticator. Yubikeys are platform-agnostic.

	▲	dingaling 2 hours ago \| parent \| next [-]
		A closed-firmware USB key is really no better option. Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage? No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.
	▲	_bent an hour ago \| parent \| prev [-]
		The issue is that operators can just curate a whitelist of authenticators they like. They could opt to not allow Yubikeys if they wanted.