Passkeys Are Not A Trap

TL;DR

Before you orderOffer from Amazon

Get everyday helpers delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security researcher Scott Helme has challenged a widely shared post urging people to abandon passkeys over attestation concerns. He says most consumer passkeys do not send attestation data to websites, while passkeys are tied to their original domains and resist phishing attacks that can defeat TOTP codes.

Security researcher Scott Helme has disputed a widely shared warning that passkeys could let websites require approved devices and software, saying the concern misrepresents how attestation works for most consumer passkeys. His rebuttal matters because the original post advised readers to return to passwords and TOTP codes, which Helme says are more vulnerable to phishing, a concern explored in an article about passkeys and consumer understanding.

The warning, titled “Passkeys are a trap. Do not use them,” argued that passkey attestation could become a “hidden dial” allowing websites to demand credentials from approved passkey managers, operating systems or firmware. It connected that possibility to concerns about modified operating systems, browser extensions and other restrictions. Helme says that scenario does not describe how mainstream synced passkeys currently work.

Most people use passkeys synchronized through services such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden. Helme says these synced credentials do not provide websites with an attestation statement. A website can request attestation, he writes, but the response from these passkeys is none. He argues that a consumer site requiring attestation would exclude nearly all its users, and says consumer-site guidance has advised against requesting it for years.

When WebAuthn attestation is supplied, Helme says, it identifies the authenticator’s make and model through an AAGUID and a vendor certificate chain. It does not reveal the user’s operating system, browser, extensions, firmware version or whether a phone is rooted or jailbroken. Helme also points out that hardware security keys such as YubiKeys do provide attestation, complicating the warning’s recommendation to use them as a way to avoid it.

Passkeys Reduce Phishing Risk

The practical dispute is about which risk people face today. TOTP codes add protection beyond a password, but users can enter them on a convincing fake site. Helme describes phishing kits that relay both the password and one-time code to the real service in real time, potentially capturing an authenticated session.

Passkeys are bound to the domain for which they were created. A browser should not offer a credential made for a legitimate domain on a lookalike address, so there is no code for a user to copy into a phishing page. Helme says the original warning acknowledged this domain-binding property but still recommended avoiding passkeys. His argument is that trading a phishing-resistant credential for a phishable one exposes users to a present risk in response to a restriction he says has not occurred for consumer logins.

That does not settle every policy concern about attestation. It does clarify the immediate security trade-off: readers deciding whether to use passkeys are weighing a documented phishing weakness in TOTP against a proposed future use of attestation that Helme says mainstream synced passkeys do not support.

How Attestation Fits WebAuthn

Passkeys are credentials used to sign in without typing a conventional password. Many consumer services synchronize them across a user’s devices through a chosen password or passkey manager. WebAuthn, the standard used for passkey authentication, can also support attestation: information about the authenticator involved in creating a credential.

Helme’s report distinguishes that capability from a broad device inspection mechanism. In his account, attestation can identify an authenticator model, but does not certify an entire operating system or disclose browser extensions and device-modification status. He says enterprise attestation can let organizations require approved hardware, while consumer sites have generally been advised not to request attestation.

The disagreement gained attention after the anti-passkey post circulated for several days and rose on Hacker News, according to Helme. He says readers sent it to him asking whether its claims were accurate. He cites his work building an open-source passkeys library, deploying passkeys in his own software service and testing implementations as the basis for his technical rebuttal.

“These passkeys don’t give websites an attestation statement at all.”

— Scott Helme, security researcher

Consumer Attestation Remains Unseen

Helme says there is no evidence in his report that consumer sites have begun requiring attested passkeys, and that the largest providers do not support attestation for their synced passkeys. The source does not provide an independent survey of websites or providers, so the scale of support across the market is not established here.

It is also unknown whether consumer services will change their policies or whether future passkey systems will handle attestation differently. The possibility that a site could request attestation is part of the technical discussion; the warning’s forecast that sites will progressively use it to restrict devices remains a prediction, not a reported development.

Watch for Login Policy Changes

For now, Helme advises using passkeys wherever sites offer them and choosing a provider users trust. Those who want to move credentials between services can check whether a provider supports credential portability. His report says people concerned about attestation should object if consumer services begin using it to restrict logins.

The next meaningful development would be a consumer website adopting an attestation requirement, or a major provider changing how its synced passkeys respond to such requests. Helme’s report does not identify a planned policy change or a specific upcoming milestone. Until one is documented, the current choice remains between available authentication methods and their known trade-offs.

Key Questions

What is the main claim in the warning about passkeys?

The warning argues that attestation could let websites require credentials from approved devices, operating systems or passkey software. Helme disputes that description of how attestation works for most consumer passkeys.

Do synced passkeys send websites information about a user’s operating system?

Helme says passkeys synced through services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not provide websites with an attestation statement. He says WebAuthn attestation, when present, identifies an authenticator model rather than the user’s operating system, browser or extensions.

Why does Helme say passkeys are safer than TOTP codes against phishing?

Passkeys are bound to the domain where they were created, so a browser should not use the credential on a lookalike phishing site. TOTP codes can be entered into fake sites and relayed to the real service, according to Helme.

Does Helme recommend hardware security keys?

Yes. Helme says YubiKeys can be useful for people seeking stronger security and that he uses them. He also notes that YubiKeys provide attestation, which conflicts with the warning’s suggestion that hardware keys avoid it.

What should passkey users watch for?

Helme says to watch for consumer websites requiring attestation to restrict which credentials they accept. His report says such a change has not happened for consumer logins, while recommending passkeys where available.

Source: hn