Comment by WorldMaker
5 days ago
Apple does not support Passkey attestation on consumer devices. They've said between user privacy concerns and user experience concerns (syncing and backup are critical requirements to non-technical users) they will not support attestation on consumer passkeys. They worked through the standards process to push compromise standards that are not attested but help with some of the "compliance issues" that might have come to require consumer passkey attestation (these are the uvi and uvm extensions which are not attested and essentially are "I solemnly swear a biometric unlock was used to access this key" for basic 2FA/MFA CYA).
So the "biggest providers" very much have some champions against attestation.
Huh, good to hear. And this makes me not trust the article at all.
> syncing and backup are critical requirements to non-technical users
hardware-bound webauthn tokens are also important since they are more secure
A caveat to this is that you can use an arrested passkey on a consumer Apple device via something like Microsoft Authenticator.
The big situation is enrolling an Apple consumer device under corporate management, which Apple calls "Declarative Configuration" and others call things like MDM. Declarative Configuration can turn on Apple's support for attestation (and is today "the only way" to get Apple's official attestation support).
Declarative Configuration is also the thing that allows the controlling corporation to remotely wipe the phone and other such things where they own the phone more than you do.
I know not every person has the luxury of telling their employers that they will not install corporate apps on personal phones and that if their employer wants to own their phone they should pay for a separate work phone. But that is the big scenario to avoid attestation becoming more common in the wild, making sure people realize that "No work apps on personal phones" is maybe something worth striking about.
And supposedly Microsoft Authenticator refuses to run on a jailbroken iPhone