WebAuthn Attestation purpose and neccessity is incorrect

Open files/en-us/web/api/web_authentication_api/attestation_and_assertion/index.md and locate the Attestation section. Read the linked WebAuthn specification references before assessing the proposed wording and its claims about attestation, multi-factor credentials, and credential backup. Done means the section accurately reflects the agreed WebAuthn guidance and retains appropriate supporting links.

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion

What specific section or headline is this issue about?

Attestation

What information was incorrect, unhelpful, or incomplete?

(Emphasis added)

The purpose of attestation is to cryptographically prove that a newly generated key pair came from a specific device. This provides a root of trust for a newly generated key pair as well as being able to identify the attributes of a device being used (how the private key is protected; if / what kind of biometric is being used; whether a device has been certified; etc.). It should be noted that while attestation provides the capability for a root of trust, validating the root of trust is frequently not necessary.

What did you expect to see?

(Changes in bold)

The purpose of attestation is to cryptographically prove that a newly generated key pair came from a specific device model or batch. This provides a root of trust for a newly generated key pair as well as being able to identify the attributes of a device being used (the provenance of the device; how the private key is protected; if / what kind of biometric is being used; what PIN complexity requirements apply; whether a device has been certified; whether it has been recalled for security defects; etc.). Verifying a credential's attestation is necessary to prove it is a self-contained multi-factor credential.

Do you have any supporting links, references, or citations?

Without valid attestation, credentials cannot be proven to be multi-factor - they only prove "something you know" (a credential's private key).

A multi-device credential can be copied. The user verification bit on these credentials cannot be trusted.

A hardware authenticator that has known security defects can also not be trusted to protect its key material or enforce user verification restrictions.

A credential can only be trusted as a self-contained multi-factor credential by verifying the attestation at registration time, and periodically revalidating attestation (if that was revoked due to defects).

Do you have anything more you want to share?

No response

MDN metadata