undefined | Better HN

0 points_1tem1y ago0 comments

Attestation statements can be used to restrict WebAuthn use to certain hardware keys only.

0 comments

2 comments · 1 top-level

hamandcheese1y ago· 1 in thread

But is there a chain of trust going all the way back to the manufacturer? Or is that simply metadata which could be spoofed?

gruez1y ago

Yes. That's what attestation is for.

j / k navigate · click thread line to collapse