TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Security researcher Scott Helme has challenged a widely shared post urging people to avoid passkeys, arguing that its account of attestation misstates what websites can learn. He says consumer synced passkeys do not send attestation statements and that switching to TOTP codes can leave users more exposed to phishing.
Security researcher Scott Helme has challenged a widely circulated warning that passkeys could let websites restrict logins to approved devices and software, saying the post misrepresents how passkey attestation works. Helme argues that common synced passkeys do not provide websites with attestation statements, while replacing passkeys with one-time codes can make accounts more vulnerable to phishing.
The post Helme disputes, titled “Passkeys are a trap. Do not use them,” advises readers to stop using passkeys and return to passwords and time-based one-time password (TOTP) codes. Its central concern is attestation: a WebAuthn feature that can provide information about the authenticator used to create a credential. The post suggests that websites could use it to demand approved software or operating systems.
Helme says that concern does not describe the passkeys most people use. Passkeys synced through services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not return an attestation statement to a website, he writes. He says a site could request attestation, but the response from these consumer passkeys would be none. He also says consumer-site guidance has for years been not to request attestation.
When attestation is present, Helme says, it identifies the make and model of an authenticator using an AAGUID and a vendor certificate chain. He disputes the claim that it reveals a user’s operating system, browser, extensions, device modifications or firmware version. Helme cites his experience building and testing passkey systems, including an open-source library, as the basis for his account.
Why Phishing Resistance Matters
The disagreement matters because it affects whether users choose a credential that is resistant to a common form of account theft. TOTP codes offer a second step beyond a password, but a user can still be tricked into entering a valid code on a phishing site. Helme says attackers can relay that code to the real service and capture a logged-in session.
Passkeys work differently: a credential is bound to the website domain where it was created. A browser should not offer a passkey for a lookalike domain, limiting the chance that a user can be tricked into handing over a reusable code. The distinction is relevant to people deciding whether a passkey manager is trustworthy and to organizations weighing login security against device requirements.
Helme’s account is a rebuttal by a security practitioner, not evidence that every passkey implementation is flawless or that attestation could never be used in a consumer setting. His narrower point is that the specific device-monitoring scenario described in the viral post does not follow from the behavior of ordinary synced passkeys.
As an affiliate, we earn on qualifying purchases.
What Passkey Attestation Reports
Passkeys use the WebAuthn standard to authenticate users without requiring them to type a password. They may be stored on a device or synced through a credential manager. The source report focuses on the latter, which Helme describes as the kind used by most people.
Attestation is a separate mechanism that can accompany credential creation and provide information about an authenticator. Helme says hardware security keys such as YubiKeys are among the devices that can provide attestation certificates. He notes that enterprise attestation can let organizations require particular hardware, but says this is different from ordinary consumer passkeys revealing a user’s operating system or browser.
The original warning also recommends hardware keys while criticizing attestation. Helme points out that this recommendation sits uneasily with the concern because YubiKeys can provide attestation. He says he still recommends them to people who want a hardware key, while distinguishing that choice from using synced passkeys.
“Your Passkeys Don’t Attest”
— Scott Helme
WebAuthn compatible security device
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Attestation Debate
The source material does not identify the author of the warning post or provide its publication date, and it does not independently document how many readers saw or acted on it. Helme’s response describes the behavior of common synced passkeys, but the material does not supply a survey of every provider or implementation.
It is also unclear whether any consumer website will seek attestation in the future. Helme says this has not happened in the scenario he discusses and argues that doing so would exclude most users of synced passkeys. That is his assessment; the source does not offer a forecast or a formal policy commitment from websites. The report also does not establish that all passkey systems or account-recovery processes carry the same protections.
password manager with passkey support
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Users and Sites Can Watch
Helme advises readers to keep using passkeys where services offer them and to store them with a credential manager they trust. People who want to move credentials between providers can check whether a manager supports portability. The source does not specify a single provider as the right choice.
For websites, the practical issue is whether they request attestation and what they do with the resulting information. Helme says users should object if consumer services begin requiring attested credentials. No such change is reported in the source, so the immediate development is a public dispute over passkey risks rather than a newly announced website policy.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the claim that passkeys are a trap?
A post cited by Helme argues that attestation could let websites require approved software or operating systems. Helme disputes that description, saying ordinary synced passkeys do not send websites attestation statements.
What can passkey attestation tell a website?
According to Helme, when present, WebAuthn attestation can identify an authenticator’s make and model through an AAGUID and vendor certificate. He says it does not identify the user’s operating system, browser, extensions or firmware version.
Are TOTP codes less secure than passkeys?
Helme says TOTP is stronger than using a password alone but remains vulnerable to phishing: a user can enter a valid code on a fake site, where an attacker may relay it to the real service. Passkeys are bound to the site domain and are designed to prevent that type of credential use on an impostor site.
Should users stop using passkeys?
Helme recommends continuing to use passkeys where available and choosing a trusted credential manager. His advice is based on his view of current passkey behavior; the source does not assess every provider or implementation.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
