Passkeys Are Not a Trap, Actually
Original: Passkeys are not a trap
Why This Matters
Misinformation about passkeys could slow adoption of phishing-resistant authentication.
Security researcher Scott Helme rebuts a viral post urging users to abandon passkeys for TOTP codes, arguing the post misrepresents how attestation works and ignores passkeys' key phishing protection.
A post titled 'Passkeys are a trap. Do not use them.' circulated widely on Hacker News, prompting security researcher Scott Helme to publish a point-by-point rebuttal. The original post warned that passkey attestation could let websites restrict logins to approved software and hardware, framing it as a creeping surveillance mechanism.
Helme's core counter: most consumer passkeys — stored in iCloud Keychain, Google Password Manager, Bitwarden, or 1Password — return no attestation statement at all when a site requests one. Any site that required attested passkeys would instantly lock out nearly its entire user base. Consumer guidance from standards bodies has advised against requesting attestation for years.
The original post also claimed attestation reveals OS, browser, extensions, and firmware. Helme says that's simply wrong. WebAuthn attestation identifies the make and model of the authenticator via its AAGUID, nothing more.
The sharpest irony: the post recommends YubiKeys to avoid attestation. YubiKeys ship with Yubico-issued attestation certificates by default — they're among the most attested authenticators available.
On TOTP, Helme is direct. Real-time phishing kits like Evilginx can intercept TOTP codes mid-session. Passkeys are domain-bound, so a browser won't submit credentials to a spoofed site — the protection TOTP cannot offer.