> If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions.

Remote attestation is never to your advantage. To do it at all, they have to restrict you to a specific set of device manufacturers and yours may not be on the list.

Then, what does it get you? Google-approved Android phones are allowed, but any attacker can trivially get one of those so knowing it's that type of device is completely worthless. All it does is prevent you from using some other type of device.

Notice that this is different from keeping the key in a HSM, which you can do without remote attestation and without the other side having to do anything at all.

Worse, the "approved" devices often have worse security than the one you want to use, e.g. using a Yubikey as your HSM will generally be better than using a phone which has orders of magnitude more attack surface and is constantly connected to the internet, but the phone is way more likely to be on the approved list than the Yubikey.

▲

dist-epoch 2 hours ago | parent [-]

Attestation is to your advantage if your phone gets rooted/hacked (evil maid attack). It will let you know that something is wrong when you try to login into an attested site.

Like SecureBoot.

	▲	_ZeD_ 2 hours ago \| parent \| next [-]
		never, ever in my life I've seen SecureBoot doing anything ever remotely advantageous for me.
	▲	serf 2 hours ago \| parent \| prev \| next [-]
		the reality is that evil maid attacks, and more broadly (and realistically) physical access attacks are exceedingly rare. The vast majority of stolen credentials are phished or some other social-engineering trick, not James Bond sneaking in with his badusb.
	▲	AnthonyMouse 2 hours ago \| parent \| prev [-]
		Then you just entered your unlock code / password into the compromised device which immediately transmits it to the attacker who has your real device. On top of that, secure boot doesn't require remote attestation. If your device doesn't like the new configuration then it doesn't release the key. The site has nothing to do with that except insofar as you need the key to sign into it. Your device manufacturer's key doesn't have to sign anything, all your device has to do is not give up your key unless the device is in the configuration you specified. And if it will do that then it would also sign an attestation to the same effect, so remote attestation still provides you with no advantage whatsoever.