To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.
Oct 12, 2026, 5:09 PM@rmondello now how do we convince Chase that if I sign in with my passkey, I don’t also need to answer an SMS 2FA challenge
@joe @rmondello Amazon.ca does this with TOTPs (at least on macOS). It’s like they heard passkeys can replace passwords and took it to mean *only* passwords.
@rmondello 👋 beg pardon, what is attestation? I presume that different than the site asking me if I want to create a passcode?
Oct 12, 2026, 6:02 PM@atlauren attestation is when you attach a cryptographic proof that *something* (here, authentication) is done on an approved/legit/not-tampered-with device. For example, a non-jailbroken iOS or Android device.
Oct 12, 2026, 6:50 PM@rmondello @varx It seems like allowlisting (without attestation) would just lead to history repeating itself as with User-Agents, right? Every Passkey vendor would identify as “Mozilla/5.0” and there would be no reliable way to detect them any more. Play stupid games, win stupid prizes.
Oct 12, 2026, 10:42 PM@dmd @rmondello That's something I'm not clear on. Without attestation, can a passkey implementation simply *pretend* to be another? Would that require extracting signing keys or something from hardware or software?
@varx @dmd @rmondello no, attestation and identification are different. Any authenticator can self-identity to the website, so that the website can use the (unattested) identity for display purposes. (E.g., a website could list the logo of the password manager next to the credential in the accounts page). Any authenticator can pass any value, so it is useless as a security property; it is solely for the purpose of user experience. >>.
@varx @dmd @rmondello Attestation involves proving that the authenticator actual is the authenticator in the returned identity, and has the security properties thereof. This indeed is useful to certain websites, namely enterprises. This is accomplished by proving possession of a cryptographic key that is maintained by the authenticator's vendor. >>
@varx @dmd @rmondello This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.
Oct 13, 2026, 3:31 AM@iinuwa @dmd @rmondello OK, so barring attestation, we should expect passkey implementations to be able to evade any blocks/filtering on specific implementations?
(That would be good, except for what maybe happens when this becomes common, and then sites get fed up at this and then start insisting on attestation.)