Passkeys Are Not A Trap

Security researcher Scott Helme has challenged a widely shared warning that people should stop using passkeys, saying the post misrepresents how attestation works for the synced passkeys most consumers use. Helme argues that replacing passkeys with passwords and time-based one-time passwords, or TOTP codes, leaves users more exposed to phishing because those codes can be relayed to a real service by an attacker.

The post Helme is responding to, titled Passkeys are a trap. Do not use them., argues that passkey attestation could allow websites to check whether a credential was created by approved software or an approved operating system. Its author warns that sites might use such checks to restrict users’ devices and software, and recommends passwords with TOTP codes instead. Helme says this prediction does not reflect how consumer passkeys currently work.

According to Helme, passkeys synced through services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not return an attestation statement to websites. He says a site could request attestation, but would receive none from these common synced credentials. Helme also argues that consumer-site guidance has for years been not to request attestation. His assessment is based in part on his work building an open-source passkeys library; the source does not provide independent test results alongside the article.

Helme says attestation, when present, identifies an authenticator’s make and model, using an identifier and a certificate chain from the vendor. He disputes the opposing post’s description of it as proof of a user’s operating system, browser, extensions, device modifications or firmware version. He also points out that hardware keys such as YubiKeys can provide attestation, even though the post recommends them as an alternative.

Why phishing resistance matters

The disagreement matters because it could influence whether users adopt credentials designed to reduce account takeovers. A TOTP code can be entered into a convincing fake login page. Helme says real-time phishing tools can relay that code, along with a password, to the legitimate website and capture the resulting session. The source describes this as a common route to account compromise, though it does not provide figures quantifying its prevalence.

Passkeys work differently: a credential is associated with the domain where it was created, so the browser should not use a passkey for a lookalike domain. That domain binding makes passkeys resistant to this kind of credential phishing, rather than relying on users to recognize a fraudulent page or keep a temporary code secret. Helme’s argument is not that passkeys have no security or usability limitations, but that the proposed alternative gives up a specific protection without evidence that the feared attestation checks are happening on consumer sites.

For readers deciding how to secure accounts, the practical distinction is between a current, documented feature and a possible future policy. Helme says the attestation scenario described in the warning has not materialized for ordinary synced passkeys. He recommends continuing to use passkeys where available and choosing a provider users trust, while opposing any future expansion of attestation requirements for consumer logins.

How passkey attestation works

The dispute centers on WebAuthn attestation, a mechanism that can let a website receive information about the authenticator used to create a credential. Helme says this information can identify the authenticator’s manufacturer and model, backed by a vendor certificate. He says it does not establish the wider device and software details alleged in the viral post.

Helme distinguishes hardware security keys from synced passkeys stored by a password or platform manager. Hardware keys can have vendor-issued attestation certificates, and a separate enterprise feature can let organisations require approved hardware. That does not mean every site uses attestation, or that consumer passkeys routinely disclose device details. The article’s central point is that attestation capability is not the same as a common consumer login practice.

The original warning also invoked broader concerns, including browser extensions, operating-system restrictions, password sharing and proposals around image scanning. Helme’s rebuttal focuses on whether passkey attestation enables those outcomes; it does not independently assess each of those wider policy concerns. The source says the warning gained attention on Hacker News but gives no dates, readership figures or evidence of websites changing their login rules.

“These passkeys don’t give websites an attestation statement at all, and though a site can ask, what comes back is none.”

— Scott Helme

What consumer sites may require

The source does not identify a consumer website currently requiring attested passkeys, nor does it provide a survey of sites’ authentication settings. Helme says such a requirement would exclude most users of synced passkeys and argues that consumer guidance has generally discouraged requesting attestation. Whether individual websites could change those policies in the future remains open.

The rebuttal is an expert’s account, supported by his stated experience building and testing passkey systems, rather than an independent review included in the source material. The precise deployment of passkeys and attestation can vary by service and credential type. The source also does not quantify how often TOTP phishing leads to account takeovers or compare overall passkey failure rates with other authentication methods.

What users and sites can do

Helme advises users to accept passkeys where a service offers them and to store them with a credential provider they trust. People who want to move credentials between services should check whether their chosen provider supports that. His recommendation is to keep using passkeys while recognizing that provider choice and account recovery practices still matter.

For websites, the immediate question is whether they request attestation and how they explain any authenticator restrictions. Helme says consumers should push back if consumer services begin requiring attestation in the way described by the warning. The source reports no such broad change currently; any future policy shift would need to be assessed against the specific information requested and which users or devices it excludes.

Key Questions

Does a synced passkey tell a website what operating system I use?

Helme says common synced passkeys do not provide websites an attestation statement. He also says attestation, when present, identifies an authenticator’s make and model, not a user’s operating system, browser extensions or firmware version.

Are TOTP codes vulnerable to phishing?

Yes. Helme says an attacker can use a real-time phishing page to relay a password and TOTP code to the legitimate site. A passkey is tied to its registered domain, which is designed to prevent use on a lookalike site.

Do hardware keys such as YubiKeys use attestation?

Helme says YubiKeys ship with Yubico-issued attestation certificates and that enterprise attestation can support requirements for approved hardware. He still recommends hardware keys for people who want one, but says they are not an alternative for someone whose sole concern is avoiding attestation.

Should users stop using passkeys?

Helme recommends continuing to use passkeys where available and choosing a credential manager users trust. He says the attestation scenario in the viral warning has not become a typical consumer login practice; the source does not establish what every website or provider does.

Source: hn