Re: Passkeys are a trap

> at login time it's not possible to retroactively require attestation if it wasn't obtained during registration.

Of course it is, the site will reject the passkey and require you to create one that is attested.

> Are Netflix and Twitter currently requesting attestation when people register passkeys, and rejecting the registration if the user declines the permission prompt?

They could start tomorrow.

> a hypothetical and unlikely scenario.

You have not been paying attention, that scenario is where this whole thing is building towards.

> If consumer-facing sites start requesting attestation when registering passkeys, they deserve to be vigorously called out

It's going to be the banks first.

Why called out, it's all for your safety, to make sure you are not using an insecure client that might leak your data.

throwawayffffas, 10 hours ago