Re:KeePassXC pull request to add basic support for WebAuthn
by Scion9066 on Monday May 08, 2023 @07:48AM
(#35860527)
Attestation is more like:
The passkey is from this model of security key/phone.
That can then be used to have a list of allowed devices if you really need hardware backed security for example (eg you provide all your users in your org with specific security keys and don't want them registering anything else). It's not recommended to use the attestation part unless you really need it though as it restricts user choice.
Basically you’re implicitly trusting that no other CA among those trusted by common browsers will emit a certificate for your domain.
While this isn’t really nice for website certificates, and while there are some safeguards (although the strong ones got deprecated, like http key pinning) … once you go down to the granularity of a single user… not sure how that pans out.