Comment by _bent
5 days ago
The author is really missing the forest for the trees here
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
So if I was Netflix or a bank or w/ever I'd only allow new registrations from "trusted" authenticators, which would incidentally only run on iOS and play-protected Android.
The next paragraph states that Yubikeys are a registered authenticator. Yubikeys are platform-agnostic.
A closed-firmware USB key is really no better option.
Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?
No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.
There's open source ones. Nitro keys are what I've been using and they're basically flawless.
The issue is that operators can just curate a whitelist of authenticators they like. They could opt to not allow Yubikeys if they wanted.
Not only are Yubikeys agnostic, they cleanly slip from host to guest and present exactly as you expect, without a technical fight. Passkeys? I assume they could do this in a few years..