Comment by lxgr

8 days ago

Apple used to support attestation, but has removed it from recent iOS versions.

I really wish WebAuthN critics could finally update on this point. There is so much else to complain about, but nobody will listen to somebody regurgitating points stale by several years.

2 comments

lxgr

simoncion 7 days ago

> Apple used to support attestation, but has removed it from recent iOS versions [therefore, Passkey attestation isn't going to happen].

From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:

  Passkeys do not provide an attestation statement, as the attestation model currently defined in WebAuthn wasn't designed with syncing credentials in mind.
  
  Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn't make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We're working hard with W3C and FIDO to solve these problems.

Sounds to me like Apple is working hard to enable attestation. It also sounds like attestation _might_ also require sharply restricting -if not preventing- freedom to sync the attested credential.

[0] <https://news.ycombinator.com/item?id=43988852>

yencabulator 5 days ago

> sharply restricting -if not preventing- freedom to sync the attested credential
They already did that! That was the first round! It is only through community outcry that "Credential Exchange Format (CXF)" came to existence.
https://news.ycombinator.com/item?id=37836783
There was a similar thing about what Google did with Android (basically making only the built-in manager viable, for a while), but I can't find a good link.