WebAuthn attestation defaults to none, and requesting direct adds prompts without adding security

The default conveyance is none, which instructs the client to strip identifying attestation data before returning the credential. Consumer relying parties almost never need more, because verifying an attestation statement means maintaining trust anchors such as the FIDO Metadata Service and keeping them current.

Requesting direct conveyance shows an additional consent prompt in some browsers, fails outright with some providers, and returns nothing useful for synced passkeys, which frequently carry no meaningful attestation at all. Ask for attestation only when policy genuinely requires specific certified authenticator models, and understand that enforcing it means rejecting the majority of consumer passkeys, including the ones your users already have.