Nah, Apple is going to provide attestation, and since you can't or won't be able to share keys between accounts, no harm no foul.
I really wish WebAuthN critics could finally update on this point. There is so much else to complain about, but nobody will listen to somebody regurgitating points stale by several years.
From [0] (via [1]), we have the following statement from an unnamed Apple Systems Engineer:
Passkeys do not provide an attestation statement, as the attestation model currently defined in WebAuthn wasn't designed with syncing credentials in mind.
Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn't make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We're working hard with W3C and FIDO to solve these problems.
[0] <https://developer.apple.com/forums/thread/708982> (FYI: You'll need to click a button to see the second paragraph in my pull quote)
They already did that! That was the first round! It is only through community outcry that "Credential Exchange Format (CXF)" came to existence.
https://github.com/keepassxreboot/keepassxc/issues/10407
This one is specifically about 1Password: https://news.ycombinator.com/item?id=37836783
There was a similar thing about what Google did with Android (basically making only the built-in manager viable, for a while), but I can't find a good link.
Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?
So you are now locked in to the apple ecosystem forever. You now need Apple to watch Netflix from your Samsung TV.
But man... I cannot tell you how many people don't even notice the walls of the garden. Besides Apple is in competition with some huge players, more than capable of offering "Done with Apple literally trapping you? Follow this link and we'll transfer your passkeys."
That's the whole point of the FIDO specs. This is now literally impossible to do. All the vendors are weirdly okay with this I believe it's because it cuts both ways.
https://rmondello.com/2026/09/07/switching-password-managers...
https://fidoalliance.org/download-credential-exchange-specif...
No, there is a working draft of a protocol. The "format" is only for use in the protocol, not a separate thing. Thus, giving the user a file is disallowed under the spec as per §5.1.1.1 which reads
> Explicitly state that the orchestrating party only transmits the credential exchange data between the exporting provider and importing provider.
Furthermore, 1Password (who is apparently leading the way on the FIDO exchange protocol design) has not implemented _any_ passkey export on _any_ desktop platform.
It is interesting that you listed Bitwarden, since I believe that FIDO developers have specifically disavowed Bitwarden's behavior of allowing users to access their passkeys.
[1] https://github.com/keepassxreboot/keepassxc/issues/10407
[2] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
That ship has sailed a long time ago.
Most people still hanging to that part have already built a whole way of life around the Apple ecosystem and the boundaries and how to work around them have become second nature to them.
The iPhone is now near 20y old, the world also changed, most got enshitificated, and looking at kids and elderlies dealing with their iPhones and macs none of it "just works".
Looking at Japan, it was the bastion of iPhone predominance, but I'm the latest numbers 30+ yo gradually got off the train to move to android as their phone is just becoming another tool to them.
I’m sorry you’ve had a bad time though.
I'm on Android and my kid got my old iPhone. Parental controls can't be set by me.
My Apple ID still tried to contact my old iPhone when logging in as a dev.
I don't need to expand on iMessage and where messages go, it's part of the lore at this point. My wife's airport auto-swirching was also a mess to the point she disabled it.
Google Maps' time line features get randomly shut off and you only know it way after the fact.
The list just goes on and on. I also have my frustrations on other platforms, I'm just pointing out Apple is far from being great. People just get used to the rough edges after a while and tout it as "good enough".
I'm trying to get a source on this but failing, do you have a link or some wwwdc sessions where Apple detail their stance ?
I see your angle, but would take their comments more at face value: their concern is really sync, anything privacy probably being the nice side effect.
Sync has been part of their strategy for a while now, from revamping the whole iMessage stack to allow for sync, to their work on eSim etc. so the move doesn't break with their recent trends either.
That comment reminded me too that Apple had briefly talked about supporting consumer attestation if they thought they could make it private enough and the compromise they ended up supporting and delivering were the uvi and uvm extensions, which is nothing like Attestation, are not attested claims (and can be "lied" about by passkeys), but are a much more privacy preserving alternative. Since uvi and uvm were accepted as standards I've not heard of Apple mentioning consumer attestation again.
(uvi and uvm are the CYA assertions that "this key was involved in a multi-factor process such as biometric unlock" which RPs like banks can use for "due diligence" and "regulatory compliance" to require keys be MFA in some way without requiring a full Attestation. Because they aren't attested they are "I solemnly swear a biometric unlock was used" claims, but in terms of regulatory compliance that should be enough in most jurisdictions especially if you can prosecute liars as in-breach-of-contract or felony misdemeanors, which a bank can in cases of banking fraud. So these extensions are huge and another big reason this article is wrong about the slippery slope here, because Apple already made huge progress in standing up bulwarks against it, uvi and uvm extensions being big bulwarks against attestation requirements for consumers.)
If passkeys are intended for platform lock-in then Big Tech is doing a really bad job...