TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Scott Helme has challenged a widely shared post urging people to abandon passkeys over concerns about device attestation. He says most consumer passkeys do not provide attestation to websites, while passkeys resist phishing in a way that TOTP codes do not.
Security researcher Scott Helme has rebutted a widely shared post urging people to stop using passkeys, saying its central concern about websites using passkey attestation to inspect users’ devices does not describe how most consumer passkeys work. Helme argues that abandoning passkeys for passwords and time-based one-time passwords (TOTP) would leave users more exposed to phishing.
The post titled “Passkeys are a trap. Do not use them.” circulated on Hacker News and advised readers to return to passwords and TOTP codes. As Helme recounts its argument, websites could use WebAuthn attestation as a hidden control to require approved authenticators or software. He says that account overstates what attestation reveals and how widely it is used.
Helme says passkeys synchronized through services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not provide websites with an attestation statement. A site can request attestation, he writes, but the response from these synced passkeys is none. He also says consumer websites have for years been advised not to request attestation. The source does not provide an independent survey of current websites or passkey providers.
When attestation is present, Helme says, WebAuthn can identify an authenticator’s make and model through its AAGUID and a vendor certificate chain. He says it does not establish a user’s operating system, browser, extensions, rooting or jailbreaking status, or firmware version. He also points out that the opposing post recommends YubiKeys for security, although those hardware keys use attestation certificates and enterprise attestation can let organisations require approved hardware.
Why Phishing Resistance Matters
The disagreement affects a practical choice millions of account holders face: whether to use passkeys when services offer them. Helme’s central security argument is that passkeys are bound to the website domain where they were created. A browser should not offer a credential for a lookalike domain, making it harder for a phishing page to steal and relay the login information.
TOTP adds protection beyond a password alone, but a user can still enter a code on a fake site. Helme says real-time phishing tools can relay passwords and TOTP codes to a legitimate service and capture an authenticated session. His comparison is not that passkeys eliminate every account risk; it is that they address a common weakness in code-based sign-ins that the proposed alternative retains.
Attestation also matters for privacy and access. If a service required a particular authenticator, some users could be excluded or have device information exposed. Helme says that scenario is not how consumer passkeys generally operate today. The distinction helps readers assess a future policy concern without treating it as an existing feature of ordinary synced passkeys.
YubiKey hardware security key
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Attestation Dispute
Passkeys use public-key cryptography rather than a password that a user types into a website. During setup, a credential is created for a particular service; during login, the service checks a cryptographic response. The private credential is held by an authenticator or passkey manager, which may synchronize it across a user’s devices.
Attestation is a separate WebAuthn capability that can provide information about the authenticator used to create a credential. It is not the same as the passkey’s domain binding, and Helme says it does not report the wider device and software details alleged in the viral post. He also notes that organisations can use enterprise attestation to set hardware requirements, a use distinct from routine consumer logins.
Helme presents himself as a practitioner: he says he built passkey support for his SaaS company, developed an open-source passkeys library, and tested implementations. Those credentials explain his perspective but do not independently verify every claim in his rebuttal. His recommendation is to keep using passkeys through a trusted manager and to choose a provider that supports credential portability if moving credentials matters.
““Your Passkeys Don’t Attest.””
— Scott Helme
Limits of the Available Evidence
The source material is Helme’s rebuttal, not a separate audit of the original post, passkey providers or consumer websites. It does not identify the original author, provide a count of sites requesting attestation, or independently verify how every passkey manager responds. Helme’s account is specific to the synchronized passkeys he discusses, and provider behavior may differ.
It is also unclear whether any consumer service may change its attestation policy in the future. Helme says a site requiring attested passkeys would lock out almost all its own users, but the source offers no user-distribution data for that estimate. His point that such a policy could be challenged is distinct from evidence that it is currently being adopted.
The rebuttal does not claim passkeys prevent every account takeover or resolve all questions about account recovery, synchronization and provider dependence. The supplied material does not compare those risks across services, nor does it include a response from the author of the post Helme disputes.
What Users Can Do Now
Helme advises readers to continue using passkeys when a website offers them and to keep credentials with a passkey manager they trust. Users concerned about portability can check whether a provider supports moving credentials. Those who want hardware security keys can still use them, though Helme says they should understand that such keys can support attestation.
For readers concerned about attestation, Helme recommends objecting if consumer services begin requiring it. The source does not identify a planned policy change, scheduled decision or specific upcoming review. For now, the dispute turns on how passkeys are implemented and on whether future services choose to request attestation.
Key Questions
Are passkeys a trap?
Helme says no. He disputes the claim that ordinary synchronized passkeys expose detailed device information to websites and argues that passkeys offer stronger protection against phishing than passwords and TOTP codes.
What does passkey attestation reveal?
According to Helme, when present, WebAuthn attestation can identify an authenticator’s make and model. He says it does not reveal the user’s operating system, browser, extensions, rooting status or firmware version.
Can passkeys stop phishing?
Passkeys are bound to the site for which they were created, so a browser should not use one on a lookalike domain. That helps prevent credential theft through phishing, though it does not mean passkeys eliminate every account-security risk.
Are TOTP codes unsafe?
TOTP codes provide more protection than a password alone, but a user can enter one on a fake site. Helme says attackers can relay the code to the real service in real time and capture a session.
Should I use a YubiKey?
Helme says he recommends hardware security keys to people who want one. He notes that YubiKeys use attestation certificates, so they are not a way to avoid attestation altogether.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
