Comment by makeitdouble
7 days ago
Thanks a lot !
I see your angle, but would take their comments more at face value: their concern is really sync, anything privacy probably being the nice side effect.
Sync has been part of their strategy for a while now, from revamping the whole iMessage stack to allow for sync, to their work on eSim etc. so the move doesn't break with their recent trends either.
It seems a case of both. It's easier to find more written documentation than spoken documentation. Unfortunately I have no idea how to search WWDC talks or the like, because they have brought up privacy concerns many times.
That comment reminded me too that Apple had briefly talked about supporting consumer attestation if they thought they could make it private enough and the compromise they ended up supporting and delivering were the uvi and uvm extensions, which is nothing like Attestation, are not attested claims (and can be "lied" about by passkeys), but are a much more privacy preserving alternative. Since uvi and uvm were accepted as standards I've not heard of Apple mentioning consumer attestation again.
(uvi and uvm are the CYA assertions that "this key was involved in a multi-factor process such as biometric unlock" which RPs like banks can use for "due diligence" and "regulatory compliance" to require keys be MFA in some way without requiring a full Attestation. Because they aren't attested they are "I solemnly swear a biometric unlock was used" claims, but in terms of regulatory compliance that should be enough in most jurisdictions especially if you can prosecute liars as in-breach-of-contract or felony misdemeanors, which a bank can in cases of banking fraud. So these extensions are huge and another big reason this article is wrong about the slippery slope here, because Apple already made huge progress in standing up bulwarks against it, uvi and uvm extensions being big bulwarks against attestation requirements for consumers.)