Comment by creatonez

> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

This is grade A horseshit. The end goal is for enterprise passkey managers to not boot up at all and not unlock their encrypted stores if hardware attestation isn't available. There's no use in attesting a certain password manager vendor if the platform isn't helping to avoid impersonation.