Comment by kccqzy
7 days ago
The author is clearly saying that the attestation feature is a trap. Typical consumer-oriented websites don’t use this feature. Therefore it is not a trap for your users. However there is no way for users to know and understand that.
No browser or consumer password manager implements attestation. There's no need for users to know something that's simply not relevant for them.
Then remove it from the spec and everyone is happy. I don't trust big tech companies to not use this feature if it is available. They have too much incentive to be the sole gatekeeper for your ability to log in to services.
To remove it from the spec you would need to get enought votes in the FIDO alliance workgroups and board and whatnot. That's just politics.
Not if fear-mongering articles like this become widely circulated and make people believe attestation is widely used.