5 ms·

The attestation actually has nothing to do with the browser, only the holder of the passkey's key material. You can satisfy the attestation by having a passkey

The attestation actually has nothing to do with the browser, only the holder of the passkey's key material. You can satisfy the attestation by having a passkey on your Android device and doing the normal Bluetooth flow with your Firefox browser on your Framework laptop. So this mechanism is totally useless for enacting this plan. The operating system doesn't manage attestation because that's totally useless for the stated goal of the attestation system. Enterprises don't want their SaaS vendors to accept passkeys from some random employee's BitWarden, instead of the hardware keys they issued the employee. If the OS manages attestation and doesn't send anything to the relying party, then it doesn't solve anybody's problem at all.

doubled112 8mo ago
Does Firefox support the Bluetooth flow on Linux at this time?
- johncolanduoni 8mo ago
  That's a matter of implementing an open standard. Google hasn't done anything to prevent open source browsers and OSes from implementing it, and nothing in the spec makes it difficult for Firefox/Linux specifically AFAICT.
hedora 8mo ago
It seems like it will only be a matter of time before consumer sites start requiring a patched OS with an attestation bit set in the key. Also, as I understand it, sites can whitelist credential hardware. If not, then the attestation is security theater. I (or an attacker on your machine), can just make a sw emulator of a hw attestation device, and use that to protect my choice of OS, (and skim your credentials). If a whitelist exists, then my “hijack your OS” plan works: Require the builtin macos/windows/signed chrome on signed os password managers. That’s 90% of the market (and dropping) right now.
- johncolanduoni 8mo ago
  As I said, the attestation structurally does NOT attest to your OS or your browser that are displaying the website performing the authentication. It attests to the device that holds the passkey's key material, which is usually not your desktop computer.
  - Borealid 8mo ago
    The attestation is in fact readable by the FIDO Platform (the browser/OS). It is not encrypted to be readable only by the RP (web site). It talks about whatever you used to authenticate and the platform can manipulate (or omit) it.
    - johncolanduoni 8mo ago
      Yes, but the attestation does not tell the RP anything about the browser. The whole point of the nightmare scenario above was for Google to sneak browser attestation in via passkey attestation. The browser being able to see the attestation doesn’t matter for that.
debazel 8mo ago
I do not want any business with Apple/Google/Microsoft at all, including owning an Android or iPhone for hardware attestation.
- jesseendahl 8mo ago
  You don't need to use anything from Apple/Google/Microsoft. Passkeys are just WebAuthn which is an open standard.
  - debazel 8mo ago
    An open standard that has attestation in it which allows sites to block all open implementations. FIDO Alliance spec writers have even threatened that apps like KeepPassXC could be blocked in the future because they allow you to export your keys.
    - peterspath 8mo ago
      That standard also allows for importing and exporting passkeys. Apple added that in iOS/macOS/etc 26 to their platforms. https://9to5mac.com/2025/06/13/ios-26-passkeys-password-transfer/ https://9to5mac.com/2025/06/13/ios-26-passkeys-password-tran...
      - debazel 8mo ago
        The export is end to end encrypted, so you do not have ownership of the data, and the provider (Apple in this case) has full control over who you are allowed to export your keys to. (Notice how there are no options to move your keys to a self-hosted service.)

doubled112 8mo ago

Does Firefox support the Bluetooth flow on Linux at this time?

johncolanduoni 8mo ago
That's a matter of implementing an open standard. Google hasn't done anything to prevent open source browsers and OSes from implementing it, and nothing in the spec makes it difficult for Firefox/Linux specifically AFAICT.

hedora 8mo ago

It seems like it will only be a matter of time before consumer sites start requiring a patched OS with an attestation bit set in the key. Also, as I understand it, sites can whitelist credential hardware. If not, then the attestation is security theater. I (or an attacker on your machine), can just make a sw emulator of a hw attestation device, and use that to protect my choice of OS, (and skim your credentials). If a whitelist exists, then my “hijack your OS” plan works: Require the builtin macos/windows/signed chrome on signed os password managers. That’s 90% of the market (and dropping) right now.

johncolanduoni 8mo ago
As I said, the attestation structurally does NOT attest to your OS or your browser that are displaying the website performing the authentication. It attests to the device that holds the passkey's key material, which is usually not your desktop computer.
- Borealid 8mo ago
  The attestation is in fact readable by the FIDO Platform (the browser/OS). It is not encrypted to be readable only by the RP (web site). It talks about whatever you used to authenticate and the platform can manipulate (or omit) it.
  - johncolanduoni 8mo ago
    Yes, but the attestation does not tell the RP anything about the browser. The whole point of the nightmare scenario above was for Google to sneak browser attestation in via passkey attestation. The browser being able to see the attestation doesn’t matter for that.

debazel 8mo ago

I do not want any business with Apple/Google/Microsoft at all, including owning an Android or iPhone for hardware attestation.

jesseendahl 8mo ago
You don't need to use anything from Apple/Google/Microsoft. Passkeys are just WebAuthn which is an open standard.
- debazel 8mo ago
  An open standard that has attestation in it which allows sites to block all open implementations. FIDO Alliance spec writers have even threatened that apps like KeepPassXC could be blocked in the future because they allow you to export your keys.
  - peterspath 8mo ago
    That standard also allows for importing and exporting passkeys. Apple added that in iOS/macOS/etc 26 to their platforms. https://9to5mac.com/2025/06/13/ios-26-passkeys-password-transfer/ https://9to5mac.com/2025/06/13/ios-26-passkeys-password-tran...
    - debazel 8mo ago
      The export is end to end encrypted, so you do not have ownership of the data, and the provider (Apple in this case) has full control over who you are allowed to export your keys to. (Notice how there are no options to move your keys to a self-hosted service.)