Hacker News Reader

> Attestation is certainly a stain on the WebAuthn spec

Attestation is necessary for corp use cases. Adding it as an option to WebAuthn is better than forcing more standards to be developed.

View on HN

Having read the very complicated WebAuthn spec so I could implement an RP, and participated in too many stupid debates about attestation like this one: multiple, simpler specs focused on specific use cases would have been better than a single gargantuan spec that tries to do everything.

Reply on news.ycombinator.com