Even stronger, they used to support it, but now no longer do, so we know for a fact that Apple knows how to do attestation, has already expended all resources necessary to implement it, but has then actively decided to go into a different direction (i.e. that of cloud synchronization).
I believe Android still has the option to use hardware attestation, but that automatically opts credentials out of cross-device synchronization, but Apple's veto alone is enough to make attestation non-viable.
If this can't make the "WebAuthN implies mandatory attestation!!" critics update, I wonder if anything can, and how useful their criticism still is.
I believe Android still has the option to use hardware attestation, but that automatically opts credentials out of cross-device synchronization, but Apple's veto alone is enough to make attestation non-viable.
If this can't make the "WebAuthN implies mandatory attestation!!" critics update, I wonder if anything can, and how useful their criticism still is.