Comment by TeMPOraL
7 days ago
Even more strongly, they can just add it back at any time they want.
I don't get why this whole "they used to support it but removed it" is supposed to be an argument for anything.
7 days ago
Even more strongly, they can just add it back at any time they want.
I don't get why this whole "they used to support it but removed it" is supposed to be an argument for anything.
This is a generalized argument to be worried about anything, though. They did it before and then decided against it? Well, they could go back to doing it again! They've never done it? Well, they could decide to start doing it tomorrow!
More seriously, the fact that Apple previously implemented something and then removed that implementation gives us multiple pieces of information: they are technically capable of implementing it (not a huge surprise), at one point they thought that it was a good idea to implement it, at a later point they thought that it was not a good idea to implement it, they're willing to backtrack on implementation decisions in certain situations, etc... Depending on how you weight these different pieces of information, you can reach different conclusions about how likely reimplementation is in the future.
To fill out a bit more of the story, they also stopped supporting consumer attestation after arriving at a "good enough" compromise that they felt was more privacy supporting and better worked with backupable/syncable keys, the uvi and uvm extensions for Webauthn which they championed to standards. Once those standards were in place they especially saw no reason to support consumer attestation.
(Those extensions are for a Passkey manager to "solemnly swear" to an RP that a key was involved in some sort of MFA dance such as PIN unlock or biometric unlock and maybe a little bit of rough detail of what sort. Much more rough than Attestation details and not attested claims at all so a Passkey manager could lie about them, but that's enough for the sort of regulatory compliance or "due diligence" that many Banks might need from consumers to replace existing MFA logins with Passkeys. It is a relatively strong bulwark against attestation requirements for consumers.)
Any company could do something extremely user-hostile at any point, so this isn't really a compelling argument?
Do you have any argument for why they would add it back?