Debate over whether passkey attestation could lock out users
Original title: Passkeys Attestation Trap
Critics say sites could later reject non-attested passkeys; Apple and FIDO participants say consumer attestation is not the goal.
A blog post argues that FIDO passkey attestation lets websites verify authenticator properties and could later reject non-attested or independent credential managers. Apple’s implementation does not support attestation while syncing issues remain, and Apple’s Ricky Mondello says mass-market web attestation is an explicit non-goal. Commenters note sites already allowlist passkey vendors and that platforms have so far refused bank requests for attestation.
Unconfirmed: Whether major sites will later require attested consumer passkeys is disputed.
- Attestation is described as mainly used with high-assurance hardware keys.
- Apple says it is working with W3C and FIDO on synced-credential attestation.
- Mondello says OS vendors, browsers, and managers have refused consumer attestation.
- Commenters say some sites already allowlist passkey vendors.
- Vendors
- Apple
- Organizations
- FIDO AllianceW3C
From the original article
5 min read at mjtsai.comLike the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside. What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys .
By mjtsai.com via kaimac · mjtsai.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.