3 ms·
> Or you can use WebAuthn over Bluetooth to your phone, essentially using your phone's secure enclave (or its equivalent) as the key source. As far as I rememb
by lxgr 1y ago
> Or you can use WebAuthn over Bluetooth to your phone, essentially using your phone's secure enclave (or its equivalent) as the key source.
As far as I remember, attestation is fully gone on iOS ("Passkeys" or otherwise), and mostly gone on Android too.
- cyberax 1y agoIt's still there. You can request an attested credential, it just won't be synced.
- lxgr 1y agoNot on iOS, except for devices with MDM profiles explicitly opting a given RP domain in. It's unfortunately not possible to even request a non-synced credential anymore for non-MDM-approved websites.