As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and find out a specific user's identity.
So why, when I do a WebAuthentication API request, does my device serial number get sent in the Attestation Certificate?
This happens with the Yubico Security Key, Yubico 4, Key-ID (Feitian Technologies under the hood) and I'm not 100% sure, but it looks like the HyperFIDO may be doing it too.
This seems like something that can directly link a user to a specific service. Not to mention that if there was any future breach where it turns out that these manufacturers have a database linking serials to master secrets, this would be a nightmare.
Please answer to assuage my fears (or indeed confirm them, if this is the reality).
(edit: here's some code which shows where it can be grabbed. Not all devices will show a serial number here but if you print the attestation cert binary data as ASCII it is clearly visible. I will put some code up soon so one can see for oneself.)