Comment by lxgr
8 days ago
> if you require attestation you don’t require any specific provider. I.e. ban vendor lock-in: if I have a key, I should be able to use it, and move my passkey to another one if I need to.
Unfortunately this is fundamentally at odds attestation: If you trust anybody capable of providing a syntactically valid signature, it's not attestation anymore.
You can try and set up a neutral clearinghouse vetting attestation providers, but that itself will probably become a centralizing force itself, requiring expensive audits etc. – think web PKI certificate authorities, but even more complex (as you need keys in shipped end user devices, not just somebody's data center HSMs).
I think shunning attestation is largely the right move, with a very short list of exceptions (high trust e-signatures, high value bank transactions but not daily payment confirmation etc.)
> You can try and set up a neutral clearinghouse vetting attestation providers, but that itself will probably become a centralizing force itself, requiring expensive audits etc.
It is a problem, but isn’t FIDO acting as this body already wrt attestation in WebAuthn? I’m only building on top of this existing process.
Regardless, a sibling commenter has a good idea of how to sidestep this in corporate environment, and I think it should work for most of actually useful purposes.
> I think shunning attestation is largely the right move
I’m glad we’re on the same page :-) But as long as we have attestation for passkeys, I think we should at least make it as hard as humanly possible to (ab)use it as a general device attestation scheme.