> It can’t be what Amazon uses in any case, since I can use 1Password on Chrome, but not Firefox. Correct, this is not attestation using the spec, but it is bl

> It can’t be what Amazon uses in any case, since I can use 1Password on Chrome, but not Firefox. Correct, this is not attestation using the spec, but it is blocking off a device for logging into the service. To me, the relevance to attestation is that I'm just not confident that attestation "doesn't make any sense" for companies to pursue while I'm watching a service cut off a browser in a way that also doesn't make any sense for them to do. I think if attestation doesn't make sense, it should be fine for the FIDO alliance to have as part of certification that any provider implementing the spec should be supported and that roaming passkey providers should all do what Apple is doing and refuse to identify themselves. That's kind of two separate things: roaming providers should refuse to identify themselves, and also services that are claiming to support passkeys should as part of spec implementation not be allowed to do things like cut off a login from a passkey provider either by relying on attestation or by implementing their own hacky solution and doing something like sniffing the user agent.