Comment by tennysont
5 days ago
> [Attestation] say nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
Largely false. The Pixel verifies the OS and will reveal `verifiedBootState != Verified` on GrapheneOS in the attested passkey at registration, which websites may choose to reject. Apple Silicon has an undocumented SEP which prevents Asahi Linux from accessing it. There may be other examples now or in the future.
Also, I think you can deduce the device color from [1] on Android.
So, in conclusion: https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b...
[1] https://source.android.com/docs/security/features/keystore/a...
"When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up"
Was going to say, GrapheneOS must not have the same AAGUID as whatever Google Play approved type they want to whitelist.
You can claim to be whatever AAGUID you like, but attestation is based on signature chains that your TPM verifies, for which there are very few, very flaky strategies (since that's the whole point of a TPM). GOS won't be passing attestation likely ever.