4 ms·
Couldn't someone just write a software key that lies and says it's biometric? AFAIK end-to-end manufacturer attestation isn't part of the spec (yet...).
by hamandcheese 2y ago
Couldn't someone just write a software key that lies and says it's biometric?
AFAIK end-to-end manufacturer attestation isn't part of the spec (yet...).
- KomoD 2y agoThere's even an emulator built in to Chrome Dev Tools -> 3 dots -> More tools -> WebAuthn -> Enable virtual authenticator environment
- _1tem 2y agoAttestation statements can be used to restrict WebAuthn use to certain hardware keys only.
- hamandcheese 2y agoBut is there a chain of trust going all the way back to the manufacturer? Or is that simply metadata which could be spoofed?
- gruez 2y agoYes. That's what attestation is for.