Comment by littlecranky67

> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly.

The argument of the site hinges on the fact that attestation cannot be activated for an already generated passkey. But that is a BS argument. Right now, the industry tries to get the user used to the workflow of passkeys, the tools, how to use them etc.

Once a critical mass of users uses passkey, you CAN switch on attestation overnight: You simply prompt the user that he needs to create a new passkey because the old one is no longer valid. The user knows the procedure and will simply create that new passkey to be able to login, this time with attestation enabled. Hell, we even have those "You were logged out of your account for security reasons" flow everywhere (looking at you, Google). Make it a dark pattern and require that regenerating when the user needs to login the most, and voila you bait-and-switched your critical userbase.

The fact that passkeys are not expected to be backed up and freely be exported between password managers and wallets is not helping here (you are by the standard not supposed to be able to do that, but user-friendly wallet today simply ignore that part of the standard).