Apple used to support attestation, but has removed it from recent iOS versions.
I really wish WebAuthN critics could finally update on this point. There is so much else to complain about, but nobody will listen to somebody regurgitating points stale by several years.
> Apple used to support attestation, but has removed it from recent iOS versions [therefore, Passkey attestation isn't going to happen].
From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:
Passkeys do not provide an attestation statement, as the attestation model currently defined in WebAuthn wasn't designed with syncing credentials in mind.
Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn't make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We're working hard with W3C and FIDO to solve these problems.
Sounds to me like Apple is working hard to enable attestation. It also sounds like attestation _might_ also require sharply restricting -if not preventing- freedom to sync the attested credential.
For a lot of people Apple is the ecosystem they access everything through, including payment processing. That cuts both ways, but Apple has shown a clear preference for protecting user privacy when they could have chosen to do otherwise, presumably because it makes them more money in the long run.
Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?
It's not in Apples expense, it's actually in it's benefit, your keys would be in their system, and impossible for anyone (including you) to get them out of it.
So you are now locked in to the apple ecosystem forever. You now need Apple to watch Netflix from your Samsung TV.
Nah, Apple is going to provide attestation, and since you can't or won't be able to share keys between accounts, no harm no foul.
Apple used to support attestation, but has removed it from recent iOS versions.
I really wish WebAuthN critics could finally update on this point. There is so much else to complain about, but nobody will listen to somebody regurgitating points stale by several years.
> Apple used to support attestation, but has removed it from recent iOS versions [therefore, Passkey attestation isn't going to happen].
From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:
Sounds to me like Apple is working hard to enable attestation. It also sounds like attestation _might_ also require sharply restricting -if not preventing- freedom to sync the attested credential.
[0] <https://news.ycombinator.com/item?id=43988852>
1 reply →
For a lot of people Apple is the ecosystem they access everything through, including payment processing. That cuts both ways, but Apple has shown a clear preference for protecting user privacy when they could have chosen to do otherwise, presumably because it makes them more money in the long run.
Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?
It's not in Apples expense, it's actually in it's benefit, your keys would be in their system, and impossible for anyone (including you) to get them out of it.
So you are now locked in to the apple ecosystem forever. You now need Apple to watch Netflix from your Samsung TV.
14 replies →