Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.
The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.
Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.
The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.