Comment by megous
5 days ago
JS webapps have one key feature in this respect, there's no possibility for banks to force particular OS/HW on you via attestation.
5 days ago
JS webapps have one key feature in this respect, there's no possibility for banks to force particular OS/HW on you via attestation.
Passkeys come with device attestation.
Optionally. And passkeys attestation only covers the HW key for example, not the OS running the website or the website. You're still completely free to re-implement it your way + FIDO2 is a standard, so eg. if you want to write your own native app for the bank web API, or whatever else, you can and passkey attestation will not stop you.
Android app/os attestation on the other side is a complete lockdown that prevents you from creating your own apps on top of server side apis the original mobile apps use.
So get them to remove support for device attestation from the spec, or don't use passkeys.