Attestation is a statement from the authenticator about itself, signed by a key its manufacturer put there. It answers « what is this device », not « who is this person ».
When you genuinely need it
- A policy requires certified hardware, in a regulated environment for instance.
- You issue the devices yourself and want to accept only those.
- You must prove, later and to a third party, what kind of authenticator was used.
Outside those cases, asking for attestation buys you a value you will not act on.
What it costs
A failure mode. Verifying an attestation means holding trust anchors and keeping them current. An expired or missing root turns a working registration into a refusal, for a check you did not need.
A privacy question. An attestation identifies a model, sometimes a batch. It is a signal about the user that you are choosing to collect.
Compatibility. Synchronised passkeys generally provide no meaningful attestation. Requiring it excludes them, which today means excluding a great many users.
The default
attestation: none. You still get the public key, the credential identifier and the phishing resistance, which is the entire point of Webauthn. What you give up is knowing the make and model, which almost nothing depends on.
Choose deliberately, and write down the reason next to the configuration. « Because it sounded more secure » is how a registration flow acquires a failure mode nobody can explain two years later.