While WebAuthn is an open standard, but the fact that it explicitly provides attestation API [1][2] and related database that can be used to verify devices [3]

While WebAuthn is an open standard, but the fact that it explicitly provides attestation API [1][2] and related database that can be used to verify devices [3] is already worrying. Site owners really have the option to lock you into one or a dozen of ecosystems should they decide to. It is entirely possible that your home-made hardware key or software password manager will be disallowed from logging into Google or Apple. For example, Cloudflare actively uses the attestation feature [4] to replace captchas, and they probably only allow a few manufacturers. [1] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... [2] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... [3] https://fidoalliance.org/metadata/ https://fidoalliance.org/metadata/ [4] https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest...