If you don't have attestation, then I can write some JavaScript code that "return true" for the authentication callback, and log into any and every account.