you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 1 day ago (1 child)

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 21 hours ago*

    Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?

  • source
  • parent