TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Scott Helme says a widely shared warning that passkeys are a trap misrepresents how passkey attestation works. He says most synced passkeys do not provide attestation to websites and argues that passkeys offer stronger phishing resistance than one-time codes.
Security researcher Scott Helme has challenged a widely shared post urging people to stop using passkeys, saying its central warning about websites checking users’ devices through passkey attestation does not describe how most consumer passkeys work. Helme argues that avoiding passkeys in favor of passwords and one-time codes can leave accounts more exposed to phishing.
The disputed post, titled “Passkeys are a trap. Do not use them,” argues that websites could use attestation to require passkeys from approved software or operating systems. It warns that this capability could be expanded over time to exclude modified devices and certain software. Helme says that account of attestation overstates what the feature reveals and how commonly it is used.
According to Helme, most people use synced passkeys stored by services such as Apple’s iCloud Keychain, Google Password Manager, 1Password or Bitwarden. He says these credentials do not provide an attestation statement to a website. A site can request attestation, he writes, but receives none from these passkeys. Helme also says consumer websites have been advised for years not to request attestation.
When attestation is present, Helme says, WebAuthn can identify an authenticator’s make and model, supported by a vendor certificate. He disputes the claim that it proves which operating system, browser, extensions or firmware a person is using, or whether a phone has been modified. He also notes that hardware security keys such as YubiKeys can provide attestation, even though the opposing post recommends them as an alternative.
Why Phishing Resistance Matters
The disagreement affects a practical security choice: whether users should adopt passkeys or stick with passwords and time-based one-time passwords (TOTP). TOTP codes add protection beyond a password, but Helme says they can still be entered into a fraudulent site and relayed to the real service in real time. A stolen code can then help an attacker access an account.
Passkeys are bound to the website domain where they were created, so a browser should not use a credential for a lookalike address. That design reduces the chance that a person can be tricked into handing a usable credential to a phishing page. Helme’s assessment is that replacing passkeys with TOTP while waiting for a possible expansion of attestation would exchange a phishing-resistant method for one that can be phished.
The issue also highlights the difference between a technical capability and its use in a particular service. Attestation exists, and organisations can use it to restrict which authenticators they accept. Helme says that does not mean consumer websites are currently using it to check users’ broader device configuration.
As an affiliate, we earn on qualifying purchases.
What Passkey Attestation Reveals
The original warning circulated over several days and gained attention on Hacker News, according to Helme’s account. It advised nontechnical readers to abandon passkeys for passwords and TOTP codes, linking attestation to broader concerns about software restrictions, modified operating systems, ad-blocking tools and policy proposals.
Helme bases his rebuttal partly on practical experience: he says he built a passkeys library, released it as open source, and has deployed passkey support in his own software business. He also says he has tested passkey implementations and has written about their security limits. These details establish his stated experience, but the supplied source is his own report rather than an independent audit of every consumer website’s behavior.
Passkeys can be stored and synced through different providers, while some users choose physical security keys. The available options and their features vary. Helme recommends using passkeys where offered and choosing a manager users trust, particularly one that supports moving credentials if portability is a concern.
“These passkeys don’t give websites an attestation statement at all.”
— Scott Helme
password manager with passkey support
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Available Evidence
The source does not identify specific consumer websites that currently require attested passkeys, and Helme says he is not aware of such a shift. His claim that this would immediately lock out almost all users is his assessment; the report provides no independent adoption figures or survey data to quantify the effect.
It is also unclear whether the original post’s author would dispute Helme’s description or how the warning might change in response. Attestation remains a real feature, and Helme acknowledges that organisations can require approved hardware keys. The source does not establish how every passkey provider or service handles every configuration, so readers should not treat his account as a guarantee about every implementation.
As an affiliate, we earn on qualifying purchases.
What Users and Sites Can Do
Helme advises users to accept passkeys when a service offers them and store them with a trusted password or passkey manager. People who want to transfer credentials between providers can check whether a manager supports portability. He says users concerned about attestation should object if consumer services begin requiring it, while stressing that he has not seen that change occur.
For websites, the immediate security question is whether sign-in methods protect users from credential theft without imposing unnecessary device restrictions. The source does not describe any announced policy change or next technical milestone. The debate is likely to continue around how services use attestation and how clearly they explain their authentication requirements.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a passkey let a website inspect my operating system?
Helme says WebAuthn attestation, when supplied, can identify an authenticator’s make and model; it does not establish the user’s operating system, browser, extensions or firmware version.
Do synced passkeys provide attestation to websites?
According to Helme, common synced passkeys stored in services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not provide an attestation statement.
Are one-time codes safer than passkeys?
TOTP codes add security beyond a password, but Helme says they can be relayed by phishing sites. Passkeys are tied to the website domain, which helps prevent their use on lookalike sites.
Can hardware security keys use attestation?
Yes. Helme says YubiKeys provide attestation certificates, and enterprise attestation can let organisations require approved hardware keys.
What does Helme recommend?
He recommends using passkeys when available and storing them with a manager users trust. He says people concerned about attestation should push back if consumer services begin requiring it.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
