TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Security researcher Scott Helme has challenged a widely shared post urging people to stop using passkeys, arguing that its central claim about website access to device information misrepresents how consumer passkeys work. He says passkeys are domain-bound and resist phishing, while warning that attestation concerns should be treated separately from the risks of falling back to passwords and TOTP codes.
Security researcher Scott Helme has disputed a widely shared warning that passkeys could let websites restrict logins to approved devices and software, saying the post misstates how attestation works for the synced passkeys most people use. Helme argues that abandoning passkeys for passwords and time-based one-time passwords (TOTP) would leave users more exposed to phishing, because passkeys are tied to the website domain they were created for.
The post Helme is responding to, titled “Passkeys are a trap. Do not use them,” circulated in recent days and gained attention on Hacker News, according to his account. It advises readers to stop using passkeys and return to passwords and TOTP codes. Its main concern is WebAuthn attestation: the ability of some authenticators to provide a cryptographic statement about themselves during registration. The post argues that websites could use this to demand approved software or operating systems.
Helme says that concern does not describe the behavior of the synced passkeys commonly stored in services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden. He says these credentials do not provide websites with an attestation statement: a site may request one, but receives none from these passkeys. He also says consumer websites have generally been advised not to request attestation. His experience includes building passkey software and publishing a passkey library, which he says he made available as open source.
Where attestation is provided, Helme says, it identifies the make and model of an authenticator through an AAGUID and a vendor certificate chain. He says it does not identify the user’s operating system, browser, extensions, firmware version, or whether a phone is rooted or jailbroken. He also points out that hardware keys such as YubiKeys do provide attestation, complicating the opposing post’s recommendation of them as a way to avoid it. Helme says he still recommends hardware keys to people who want one, but distinguishes that advice from the claim about attestation.
Why Passkeys Resist Phishing
The disagreement matters because it concerns what users should choose to protect accounts from theft. TOTP codes add protection beyond a password, but a user can be tricked into entering a code on a fake site. Helme says an attacker can relay the password and code to the real service in real time, potentially capturing a session. Passkeys address that specific weakness by being bound to the site’s domain; a browser should not use a credential created for a legitimate site on a lookalike domain.
That protection does not settle every question about passkeys, account recovery, or the policies websites may adopt. But Helme’s argument is that avoiding passkeys because of a feared attestation policy that is not currently affecting common synced credentials would trade a phishing-resistant sign-in method for one that can be phished. His recommendation is to use passkeys where available and store them with a provider users trust.
As an affiliate, we earn on qualifying purchases.
The Attestation Dispute
Passkeys are credentials based on public-key cryptography and are commonly used as an alternative to passwords. WebAuthn, the web authentication standard involved in their use, can support attestation for some authenticators. The key distinction in Helme’s rebuttal is between attestation as a technical capability and whether the passkey in a consumer’s chosen manager actually supplies it to a website.
The original post also invoked concerns about platform control, browser extensions, and policy proposals. Helme says those arguments do not show that ordinary synced passkeys currently report device or software details to consumer sites. The supplied material does not document a consumer service adopting an attestation requirement. Helme says such a requirement would exclude most users of synced passkeys, but that is his assessment rather than a reported decision by a named service.
“These passkeys don’t give websites an attestation statement at all, and though a site can ask, what comes back is none.”
— Scott Helme
password managers with passkey support
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Open Questions on Attestation
The supplied material does not establish whether any consumer website has begun requiring attestation for passkey logins, or whether such a policy is planned. Helme says the major passkey providers do not support attestation for their synced passkeys and that consumer sites have long been advised not to request it; those statements are his account, and the source material does not include independent statements from the providers or sites.
It is also not clear from the material how the opposing post’s author would respond to Helme’s technical rebuttal beyond acknowledging, in an addendum described by Helme, that passkeys are domain-bound and resist man-in-the-middle attacks. The dispute does not resolve broader questions about service policies or account recovery, and no evidence is supplied of a website using attestation to enforce the restrictions described in the original post.
As an affiliate, we earn on qualifying purchases.
What Users Can Do Now
Helme advises users to keep using passkeys where websites offer them, save them in a password or passkey manager they trust, and check that the provider supports credential portability if moving credentials matters to them. He says users concerned about future requirements should oppose them if they arise, rather than giving up passkeys now.
The next development to watch is whether services change their registration or login requirements, and whether passkey providers make further details about attestation available. The supplied source identifies no announced policy change or specific upcoming milestone. For now, Helme’s recommendation rests on the distinction between a possible use of attestation and what he says synced consumer passkeys currently disclose.
WebAuthn compatible authenticators
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Do synced passkeys tell websites what operating system I use?
Helme says they do not. He says common synced passkeys provide no attestation statement to websites. He also says attestation, when present, identifies an authenticator’s make and model, not the user’s operating system or browser.
Why does Helme say passkeys are safer against phishing?
A passkey is bound to the domain where it was created, so a browser should not use it on a lookalike phishing site. TOTP codes can be entered on a fake site and relayed to the real service, according to Helme.
Are hardware security keys free of attestation?
No. Helme says YubiKeys provide attestation, and notes that enterprise attestation can let organisations require approved hardware. He still recommends hardware keys to people who want them, but says they do not avoid attestation as a category.
Should users stop using passkeys?
Helme’s advice is to continue using passkeys where available and keep them with a trusted manager. The source material does not report a consumer website currently requiring the attestation-based restrictions described in the opposing post.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
