Search code examples
androidgoogle-signinpasskey

Why is the metadata for the Google Password Manager aaguid:ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4 not in the public FIDO Alliance MDS V3 Service?


Is there a reason why the Google Password Manager aaguid: ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4 is not present in the list of public metadata which is hosted in the Fido Alliance Metadata service V3 blob located here: https://mds3.fidoalliance.org/

Is there a place online where this could be retrieved? How is the attestation: direct supposed to work if we have no way to retrieve server side the attestationRootCertificates as the metadata file for this aaguid is not hosted anywhere: ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4


Solution

  • Synced passkeys are not currently attested, so there is no metadata to look up outside of name and icons (to improve UX for end users).

    That is why the passkey provider AAGUID list exists: https://github.com/passkeydeveloper/passkey-authenticator-aaguids. FIDO plans to host this list directly in the future (see README in the GitHub repo).