TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Scott Helme has challenged a widely shared post urging readers to avoid passkeys, arguing that it misrepresents how attestation works and overlooks passkeys’ resistance to phishing. His account is a technical rebuttal, not a new policy change; questions about future use of attestation remain relevant, but he says consumer sites generally do not request it.
Security researcher Scott Helme has challenged a widely shared post urging people to stop using passkeys, arguing that its warning about websites identifying users’ software and operating systems misstates what passkey attestation reveals. The dispute matters because Helme says replacing passkeys with passwords and time-based one-time passwords (TOTP) can leave people more exposed to phishing.
The post Helme responds to is titled “Passkeys are a trap. Do not use them.” He says it circulated widely over several days and drew attention on Hacker News. Its author argues that websites could use passkey attestation to require approved software and operating systems, and recommends returning to passwords and TOTP codes. Helme’s response is that this scenario does not describe how common, synced passkeys work today.
Helme says passkeys stored in services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not provide websites with an attestation statement. He explains that when attestation is present, it can identify an authenticator’s make and model through an AAGUID and vendor certificate chain. In his account, it does not identify a person’s operating system, browser, extensions, device modifications or firmware version.
He also challenges the opposing post’s recommendation of hardware security keys as a way around attestation. Helme says YubiKeys provide attestation using vendor-issued certificates, and that enterprise attestation can let organisations require particular hardware. He says he still recommends such keys to people who want one, but argues they do not support the claim that hardware keys avoid attestation.
Why Phishing Resistance Matters
The practical issue for account holders is the trade-off between a concern about possible future attestation requirements and the risks of the authentication method they use now. Helme says TOTP codes are better than a password alone, but users can be tricked into entering a code on a convincing fake site. A real-time phishing relay can pass a password and code to the legitimate service and capture a logged-in session.
Passkeys are designed to bind a credential to the website where it was created. That domain binding means a browser should not offer a passkey for a lookalike address, reducing the chance that a user will hand a credential to a phishing site. Helme argues that abandoning passkeys for TOTP would give up this phishing resistance. The wider debate is relevant to anyone choosing account-security options, as well as organisations weighing convenience, recovery and control over credentials.
Helme recommends using passkeys when services offer them and storing them with a provider users trust. He also says people who want to move credentials between services should check whether their chosen provider supports that. These are his recommendations, based on his technical assessment; they are not a guarantee that every passkey setup or recovery process has identical protections.
As an affiliate, we earn on qualifying purchases.
The Dispute Over Attestation
The disagreement began with an online argument that passkeys contain a “hidden dial” that websites might gradually turn up. The original post links that concern to broader worries about platform control and restrictions on how people use devices and services. Helme says this scenario combines distinct issues and overstates what passkey attestation can reveal.
WebAuthn, the standard used for passkey authentication, can support attestation, but Helme says consumer services have generally been advised not to request it. He argues that a consumer website requiring attestation would exclude most users of synced passkeys. He also says the largest passkey providers do not support the kind of attestation feared by the opposing post. These statements are Helme’s account of current support and practice, rather than a guarantee about every service or future policy.
Helme presents himself as a practitioner: he says he built passkey support for his own software company, created an open-source passkey library and has tested passkey implementations. That background helps explain the technical basis of his rebuttal, but readers should distinguish his analysis from independent confirmation of every claim in the original post.
“Your Passkeys Don’t Attest”
— Scott Helme
What Attestation Could Mean Later
The available source does not establish that no website can request attestation, or that the practice could never change. Helme’s point is narrower: he says consumer sites have generally been advised against requesting it, common synced passkeys provide no attestation statement, and the feared restrictions are not occurring as described today.
The source also does not independently verify the opposing post’s full set of claims or provide a service-by-service audit of passkey providers. Users’ available features and account recovery options can vary by provider and website. Whether future platforms or services adopt different attestation policies remains an open question; the article offers no evidence that a broad shift is underway.
What Users Can Check Now
For now, Helme advises users to keep using passkeys when offered and to store them with a provider they trust. People concerned about transferring credentials can check whether their provider supports moving them. Anyone assessing an account should also review its recovery options, since the source does not compare recovery processes across services.
The broader issue to watch is whether consumer websites begin requesting attestation in ways that restrict which authenticators they accept. Helme says that has not happened in the scenario described by the viral post and argues that any such change would merit public scrutiny. Until policies or provider support change, his recommendation is to weigh the current phishing protections of passkeys against concerns that remain prospective.
Key Questions
What is passkey attestation?
In Helme’s description, attestation can provide a website with information identifying an authenticator’s make and model, backed by a vendor certificate. He says it does not reveal a user’s operating system, browser, extensions or device modifications.
Do synced passkeys send attestation to websites?
Helme says common synced passkeys stored in services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not return an attestation statement. The source does not provide an independent audit of every provider.
Why does Helme prefer passkeys to TOTP codes?
Passkeys are bound to the website for which they were created, which helps prevent use on a lookalike phishing site. TOTP codes can be entered into a fake site and relayed to the real one, according to Helme.
Are hardware security keys free of attestation?
No. Helme says YubiKeys provide attestation through vendor-issued certificates, and that enterprise attestation can allow organisations to require approved hardware. He still recommends hardware keys for people who want to use them.
Should users stop using passkeys?
Helme says no: he recommends using passkeys where available and choosing a trusted storage provider. That is his assessment; users should also check the recovery and portability options offered by their service.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
