Hacker News Reader

"When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up"

Was going to say, GrapheneOS must not have the same AAGUID as whatever Google Play approved type they want to whitelist.

View on HN

You can claim to be whatever AAGUID you like, but attestation is based on signature chains that your TPM verifies, for which there are very few, very flaky strategies (since that's the whole point of a TPM). GOS won't be passing attestation likely ever.

Reply on news.ycombinator.com