WebAuthn with Touch ID and Attestation not working on ARM Macs (Safari)
I found this issue when I tried to enroll my fingerprint on the Yubico demo site (https://demo.yubico.com/webauthn-technical/registration) with Safari:
I then tried other browsers like Google Chrome and Microsoft Edge, they all worked.
Upon further testing with the website https://webauthn.io (which gives more options to test), I found that if I let "Attestation Type" to be "None", the registration will success, but if it was set to "Direct" or "Indirect", the registration fails. Yubico demo site uses Attestation by default (to detect YubiKey model), which explains why it's failing.
WebKit should work with Attestation, as this blogpost https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/ said:
Attestation is an optional feature which provides websites a cryptographic proof of the authenticator’s provenance such that websites that are restricted by special regulations can make a trust decision. Face ID and Touch ID for the web offers Apple Anonymous Attestation. Once verified, this attestation guarantees that an authentic Apple device performed the WebAuthn registration ceremony, but it does not guarantee the operating system running on that device is untampered.
Some other users of Macs with Apple Chip have also encountered this problem. However one of my friend that uses Mac with x86 Processor (and Apple T2 Security Chip) didn't encounter this issue.
This issue prevents the registration of Touch ID on certain websites, Dropbox 2FA for example. Does anyone have a solution or workaround?
MacBook Pro 13″, macOS 12.1