Comment by notpushkin
5 days ago
> Who are we taking about here?
The corporate.
> I believe the goal is to know which registered (ie explicitly approved) device a login is coming from.
They can do that with non-transferrable passkeys already (assuming they hand out the devices, and trust the manufacturer to actually prevent transferring the keys out). No cosigning required here.
Right but when it comes to that plus BYOD isn't that how we end up at attestation in the first place? I figure the alternative is to manually enroll each device as its own known entity, then require two "regular" signatures to authenticate. Basically it's just the observation that if you care about whitelisting the hardware then you must either have attestation or else accomplish the same thing manually. The former is less labor intensive but comes at the cost of enabling abuse.