> Apple used to support attestation, but has
removed it from recent iOS versions [therefore, Passkey attestation isn't going to happen].
From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:
Passkeys do not provide an attestation statement, as the attestation model currently defined in WebAuthn wasn't designed with syncing credentials in mind.
Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn't make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We're working hard with W3C and FIDO to solve these problems.
Sounds to me like Apple is working hard to enable attestation. It also sounds like attestation
_might_ also require sharply restricting -if not preventing- freedom to sync the attested credential.
[0] <https://developer.apple.com/forums/thread/708982> (FYI: You'll need to click a button to see the second paragraph in my pull quote)
[1] <https://news.ycombinator.com/item?id=43988852>
From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:
Sounds to me like Apple is working hard to enable attestation. It also sounds like attestation _might_ also require sharply restricting -if not preventing- freedom to sync the attested credential.[0] <https://developer.apple.com/forums/thread/708982> (FYI: You'll need to click a button to see the second paragraph in my pull quote)
[1] <https://news.ycombinator.com/item?id=43988852>