Comment by rstuart4133

7 days ago

Not a great rebuttal.

I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.

Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.

4 comments

rstuart4133

Reply
m-p-3  6 days ago

> locks you into a single vendor

You can allow multiple attestations GUIDs (AAGUIDs) if you want, you're not limited to the larger hardware providers (ie: Yubico).

So far the only place I encountered this is within our Microsoft Entra setup, where we have to option to allow all types of Passkeys (hardware-backed, cloud synced, non-attested, etc).

Also in some scenarios you might be required to limit the enrollment of Passkeys on hardware devices that are FIPS-compliant. Having a list of AAGUIDs to enforce this makes sense.