TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Scott Helme has challenged a widely shared post urging people to abandon passkeys over concerns about attestation and device surveillance. Helme says consumer synced passkeys do not provide websites with attestation and are bound to their website domain, while TOTP codes can be phished in real time.
Security researcher Scott Helme has disputed a widely shared warning that passkeys could become a tool for websites to restrict users to approved devices and software, saying the concern misrepresents how passkey attestation works today. Helme argues that most consumer passkeys are synced through password managers and do not provide websites with attestation, while replacing them with passwords and one-time codes can leave accounts more exposed to phishing.
The warning, titled “Passkeys are a trap. Do not use them,” circulated online and rose high on Hacker News, according to Helme’s account. Its author urged non-technical users to stop using passkeys and return to passwords and time-based one-time password codes, or TOTP. The central concern was WebAuthn attestation: the ability for a service to request cryptographic information about the authenticator used to create a passkey.
Helme says most people use synced passkeys stored in services such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden. According to his explanation, these credentials do not return an attestation statement to websites; if a site requests one, the response from these passkeys is none. He says a consumer site that required attestation would exclude almost all of its users, and notes that guidance for consumer services has been not to request it.
When attestation is provided, Helme says, it identifies an authenticator’s make and model, using an AAGUID and a certificate chain from the vendor. It does not establish which operating system, browser, browser extensions or firmware a person uses, nor whether a phone is rooted or jailbroken. Helme also points to a mismatch in the warning’s recommendation: it suggests hardware keys such as YubiKeys as an alternative, but he says those devices do provide attestation, and enterprise attestation can let organisations require approved hardware.
Why Phishing Resistance Matters
The disagreement matters because it affects a practical security choice for people protecting email, financial and other online accounts. TOTP codes improve on passwords alone, but Helme says they can still be relayed to a real service by phishing sites or intermediaries. A user can enter a code on a convincing fake page, allowing an attacker to pass it on before it expires.
Passkeys are tied to the site for which they were created. A browser should not offer a passkey for example.com on a lookalike domain, reducing the chance that a user will hand a credential to a phishing page. Helme’s argument is not that passkeys have no limitations, but that abandoning them over a feared attestation policy that he says is not currently used for typical consumer passkeys may trade away this phishing resistance without preventing the scenario described.
His recommendation is to keep using passkeys where available and store them with a provider the user trusts. People who want to move credentials between services should check whether their chosen provider supports portability. The policy concern about attestation, Helme says, is worth challenging if consumer sites begin requiring it; he says that has not happened in the situation he describes.
As an affiliate, we earn on qualifying purchases.
How Attestation Fits Passkeys
Passkeys use the WebAuthn standard and are designed to authenticate users without requiring them to type a password or a short-lived code into a website. A passkey is associated with the website domain, which is why Helme says it offers protection against credential phishing. Passkeys may be stored on a device or synced through a provider, depending on the user’s setup.
Attestation is a separate capability that can provide information about the authenticator during registration. Helme distinguishes that from claims that a site can use attestation to verify a person’s complete software environment. He also says the original warning linked its concern to broader issues, including FIDO Alliance membership and proposals in the UK, but his rebuttal focuses on what passkey attestation itself communicates and what consumer passkeys return in practice.
Helme says he has built and deployed passkey support, developed an open-source passkey library and tested implementations. Those details describe his experience and underpin his assessment; they do not independently establish how every website or passkey provider will behave in the future.
“The passkeys most people use are synced passkeys.”
— Scott Helme
As an affiliate, we earn on qualifying purchases.
Limits of the Current Evidence
The source material does not identify the author of the viral warning or provide independent testing of every passkey manager, operating system or website. Helme’s statements describe the common synced-passkey setup and his own technical assessment; they should not be read as proof that all passkey implementations behave identically.
It is also not clear whether any consumer service will require attestation in the future. Helme says the practice has not occurred for the consumer logins he discusses and that the major providers do not support it. That is a description of the current situation in his report, not a guarantee about future policy or every service. The source does not document a particular site changing its rules or provide a response from the warning’s author.
As an affiliate, we earn on qualifying purchases.
Watch for Consumer Login Policies
The immediate practical step for users is to review which authentication options their services offer and use a trusted passkey manager where passkeys are available, according to Helme. Users concerned about portability can check whether their provider supports moving credentials. Those who prefer hardware security keys can still use them, while recognizing Helme’s point that such keys may involve attestation.
The policy issue to watch is whether consumer websites begin requiring attestation to accept passkeys. Helme says users should push back if that happens, but reports no such shift in the consumer services he describes. Whether providers change their support, and whether sites introduce new requirements, remains a future question rather than a confirmed development in this report.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the claim that passkeys are a trap?
A widely circulated post argued that passkey attestation could let websites restrict logins to approved authenticators, software or operating systems, and advised readers to use passwords and TOTP codes instead. Scott Helme disputes that description of how attestation works.
Do synced passkeys tell websites what device or operating system I use?
Helme says common synced passkeys from providers such as Apple, Google and password managers do not return an attestation statement to websites. He says attestation, when present, identifies the authenticator’s make and model, not a user’s full operating system, browser or extension setup.
Are TOTP codes as resistant to phishing as passkeys?
No. TOTP codes are stronger than a password alone, but Helme says a user can enter a code on a phishing site that relays it to the real service. Passkeys are bound to their website domain, so they are designed to resist that kind of credential capture.
Should I stop using passkeys?
Helme recommends continuing to use passkeys where available and storing them with a provider the user trusts. His report says concerns about consumer sites requiring attestation are not a reason to abandon passkeys now, though future policy changes remain possible.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
