News for hackers. Stuff that matters.

A comment on Breaking WebAuthn, FIDO2, and Forging Passkeys. Parent comment

Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by lxgr on Tuesday June 24, 2025 @01:30PM (#44368613)
> Or you can use WebAuthn over Bluetooth to your phone, essentially using your phone's secure enclave (or its equivalent) as the key source.

As far as I remember, attestation is fully gone on iOS ("Passkeys" or otherwise), and mostly gone on Android too.

[ Parent | on HN ]
Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by cyberax on Tuesday June 24, 2025 @01:32PM (#44368634)
It's still there. You can request an attested credential, it just won't be synced.
[ Parent | on HN ]
Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by lxgr on Tuesday June 24, 2025 @01:45PM (#44368780)
Not on iOS, except for devices with MDM profiles explicitly opting a given RP domain in.

It's unfortunately not possible to even request a non-synced credential anymore for non-MDM-approved websites.

[ Parent | on HN ]