TL;DR
Get business pricing on your home office setup
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Security researcher Scott Helme has challenged a widely shared post urging people to avoid passkeys, saying its claims about website attestation do not reflect how common synced passkeys work. He says passkeys resist phishing because they are tied to the website they were created for, while one-time codes can be stolen through real-time phishing. The wider concern about how attestation might be used remains a policy issue, not a practice Helme says is currently affecting consumer passkey logins.
Security researcher Scott Helme has challenged a widely shared warning that people should stop using passkeys, arguing that common synced passkeys do not provide websites with the device attestation described in that post and that switching back to one-time codes can leave users more vulnerable to phishing. The disagreement matters because it concerns the security and privacy trade-offs behind a sign-in method increasingly offered by online services.
Helme’s response addresses a post titled “Passkeys are a trap. Do not use them.” He says it had circulated for several days and reached a high position on Hacker News. The original post advised non-technical readers to return to passwords and time-based one-time password codes, or TOTP, arguing that passkey attestation could let websites restrict access to approved software and operating systems.
Helme says most passkeys used by consumers are synced credentials held in services such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden. According to his account, those credentials do not return an attestation statement to websites. He says a site could request attestation, but would receive none from these passkeys. He argues that a consumer service requiring attestation would risk locking out most of its users, and says consumer-site guidance has for years advised against requesting it.
Helme also disputes the claim that attestation verifies a person’s operating system, browser, extensions, or whether a phone has been modified. He describes WebAuthn attestation, when provided, as identifying the make and model of an authenticator through an AAGUID, with a vendor certificate chain. He says it does not establish those broader details about a user’s device or software.
Why Passkeys Change the Phishing Risk
The practical disagreement is not only about privacy; it is also about what users give up if they replace passkeys with TOTP codes. Helme says a TOTP code can be entered on a convincing fake site and relayed to the real service in real time. In that scenario, attackers may capture an authenticated session even though the account uses a second factor.
By contrast, a passkey is bound to the website’s domain, according to Helme. A browser should not use a credential made for one domain on a lookalike address. That design reduces the chance that a user can be tricked into handing over a reusable code. It does not mean every account or passkey implementation is immune to compromise, but it changes the specific phishing risk at issue.
Helme recommends that users continue using passkeys where services offer them and store them with a provider they trust. He also says users who want to move credentials between services should choose a provider that supports portability. His recommendation is an assessment by a security practitioner, not a guarantee that every provider’s policies, recovery process or implementation will suit every user.
As an affiliate, we earn on qualifying purchases.
The Attestation Dispute Explained
The original warning presents attestation as a mechanism that could gradually let websites demand approved passkey managers, operating systems and device configurations. It links that concern to broader debates about browser extensions, operating-system controls and proposals involving image scanning. Helme says this interpretation conflates what attestation can report with wider forms of device verification.
Attestation is not the same thing as a passkey’s core authentication function. In Helme’s description, attestation can identify the authenticator model when supplied; it does not automatically reveal a user’s browser extensions or operating-system state. He says the synced passkeys most consumers use do not provide the attestation data at issue. His account is grounded in his work building a passkeys library and deploying passkey support, but the source material does not include independent testing of every provider or service.
The original post also recommended hardware security keys such as YubiKeys as an alternative to passkeys. Helme points out that YubiKeys can provide attestation certificates and that enterprise attestation can let organisations require approved hardware. He says he still recommends such keys for people who want one, but argues they do not support the original post’s case against attestation.
““These passkeys don’t give websites an attestation statement at all.””
— Scott Helme
As an affiliate, we earn on qualifying purchases.
Open Questions About Attestation Use
The supplied material does not establish that no consumer website has ever requested attestation; Helme’s narrower claim is that common synced passkeys return none and that consumer-site guidance has discouraged requests. It also does not document a current move by major consumer services to require attested passkeys. Helme says such a shift has not happened, but the article provides no independent survey of websites or providers.
It remains unclear how future services might use attestation, whether provider support could change, or how policies around enterprise and consumer sign-ins may develop. The source also does not compare recovery arrangements, account-security settings or the risks of every passkey provider. Those details can affect a user’s experience even when the credential itself is phishing-resistant.
As an affiliate, we earn on qualifying purchases.
What Users and Services Can Watch
For now, Helme’s advice is to use passkeys when available, select a trusted manager and check whether it supports credential portability if moving accounts matters. Users should also retain access to their provider’s recovery options and follow the security guidance for each account. These steps address practical account access without treating a hypothetical expansion of attestation as an established change.
The development to watch is whether consumer websites begin requiring attestation, and what information they request or receive if they do. Helme says users should push back if that happens. The source material does not identify a scheduled policy decision, announced service change or regulatory milestone; the disagreement remains a dispute over the current capabilities of passkeys and the possibility of future restrictions.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the main argument against avoiding passkeys?
Helme says common synced passkeys do not provide websites with the attestation data described in the warning, while passkeys’ domain binding makes them harder to steal through phishing than TOTP codes.
What does passkey attestation reveal?
According to Helme, WebAuthn attestation can identify an authenticator’s make and model and provide a vendor certificate chain. He says it does not reveal a user’s operating system, browser extensions, or whether a phone is rooted or jailbroken.
Are TOTP codes unsafe?
TOTP is stronger than using a password alone, but Helme says a user can enter a code on a fake site where an attacker relays it to the real service. Passkeys are designed to resist that form of phishing by being tied to a domain.
Should users stop using hardware security keys?
No such recommendation follows from Helme’s response. He says he uses and recommends YubiKeys for people who want them, while noting that hardware keys can provide attestation and therefore do not avoid attestation in the way the warning suggests.
Could websites require attested passkeys in the future?
The source describes that as a concern raised by the opposing post, not a current change established by the material. Helme says consumer sites have not made this a normal requirement and argues users should respond if that practice emerges.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
