Comment by djfergus
8 days ago
Attested passkeys are a dream for Apple. While google is sliding down this slippery slope fastest (eg MEETS_STRONG_INTEGRITY to require security updates) Apple has the most to gain commercially, they must be salivating over the prospect of accelerating device replacement (and blocking Linux/android forks) driven by banks, streaming media and governments.
Apple is the one major tech company not implementing attested passkeys, actually.
Well they built it, verified everything was in place, presumably got some tick from govt/banks/etc then removed it. I’d love to know what happened/what they are thinking. And what happens next and when.
Do you think they did that to keep us FOSS neckbeard hackers happy?
Apple also built remote attestation into their browser, I don't think they care much about FOSS neckbeard hackers. They probably see the same privacy and security risks and didn't see a reason to go along with the rest.
Apple is perfectly fine with taking control of your privacy if they're the ones in control, and in this case they would have to put third parties in control instead. I'm sure they'd much rather take control themselves and build these types of checks into their "Sign in with Apple ID" buttons instead, so they can put "if you want Human Proven Secure Attested devices (invented by Apple), let your users sign in with Apple ID" on their website.