TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Security researcher Scott Helme has challenged a widely shared post urging readers to abandon passkeys, arguing that its claims about device attestation misstate how common synced passkeys work. He says passkeys resist phishing because they are tied to a website’s domain, while time-based codes can be relayed to attackers.
Security researcher Scott Helme has disputed a widely shared warning that passkeys are a trap, saying the post misrepresents how attestation works for the synced credentials most people use. Helme argues that abandoning passkeys for passwords and time-based one-time codes could leave users more exposed to phishing, because passkeys are tied to the website for which they were created.
The post Helme is responding to, titled “Passkeys are a trap. Do not use them,” advises non-technical readers to stop using passkeys and return to passwords and time-based one-time password (TOTP) codes. Its central concern is that websites could use passkey attestation to demand proof of which software or device created a credential, then restrict access to approved systems.
Helme says that account of attestation is inaccurate for mainstream synced passkeys, which are stored by services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden. He writes that these passkeys do not provide websites with an attestation statement; a site can request one, but receives none from these credentials. He says consumer websites have been advised not to request attestation for years and would risk locking out most users if they required it.
Where attestation is present, Helme says, WebAuthn can identify an authenticator’s make and model through an AAGUID and a vendor certificate chain. He says it does not report a user’s operating system, browser, extensions, whether a phone is rooted or jailbroken, or its firmware version. The source material does not independently verify Helme’s technical account, but he cites his work building passkey software and testing implementations.
Why Phishing Resistance Matters
The disagreement matters because the recommended alternative changes the kind of risk users face. TOTP codes add protection beyond a password, but a user can be tricked into entering a code on a fraudulent site. Helme says real-time phishing tools can relay both the password and code to the legitimate service and capture the resulting session.
Passkeys are designed to avoid that particular failure: the credential is bound to its website domain, so a browser should not offer a credential for a lookalike domain. That makes passkeys resistant to the kind of credential relay Helme describes. It does not mean passkeys eliminate every account-security risk, but it is a practical distinction for readers deciding whether to switch back to codes.
The dispute also highlights a difference between a technical capability and its use in ordinary consumer logins. Attestation exists, and organizations can use it to require specified hardware. Helme’s point is that this does not mean typical synced passkeys reveal device details or that consumer websites are currently using attestation to enforce approved operating systems.
As an affiliate, we earn on qualifying purchases.
The Attestation Dispute
The original warning, according to Helme, gained attention on Hacker News over several days and was forwarded to him by readers asking whether its claims were true. It argued that attestation could become a “hidden dial,” allowing websites to gradually require approved software and operating systems. It also linked the concern to issues including browser extensions, FIDO Alliance membership and proposed image-scanning policies in the United Kingdom.
Helme challenges both the proposed mechanism and the post’s recommendation of hardware security keys. He says devices such as YubiKeys do support attestation and ship with Yubico-issued certificates; enterprise attestation can let organizations require approved keys. He says he still recommends such keys to people who want them, while arguing they are not a way to avoid attestation.
Helme identifies himself as the creator of WhyNoPasskeys.com and says he has built passkey support for a software business, developed an open-source passkeys library and conducted security testing. Those credentials provide context for his response, but the source is his own report rather than an independent technical assessment of the competing post.
““The passkeys most people use are synced passkeys.””
— Scott Helme, responding to the anti-passkey post
As an affiliate, we earn on qualifying purchases.
What Consumer Sites Request
The supplied material does not include an independent audit of websites’ current attestation practices or a list of services that request attestation. Helme says mainstream synced passkey providers return no attestation and that consumer sites have long been advised not to request it; the source provides no site-by-site data to assess how consistently that guidance is followed.
It is also unclear whether any consumer service will adopt stricter attestation requirements in the future. Helme describes that as a possibility to challenge if it occurs, not a change he says is already taking place. The source does not detail how every passkey provider handles portability, recovery or account access after a lost device, so users’ experience can depend on the service they choose.
As an affiliate, we earn on qualifying purchases.
Keep Using Passkeys, Helme Says
Helme’s recommendation is to continue using passkeys where websites offer them and store them with a password or passkey manager users trust. Readers who want to move credentials between providers should check whether the service they choose supports that portability.
He also says users concerned about attestation should oppose consumer login requirements if they emerge. No policy change or specific upcoming decision is identified in the source material; for now, the dispute is about how to interpret an existing security feature and whether it justifies giving up passkeys.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the main dispute about passkeys?
One post warned that websites could use attestation to restrict which devices or software can use passkeys. Scott Helme disputes that description, saying common synced passkeys do not provide websites with attestation statements.
What information can passkey attestation provide?
Helme says WebAuthn attestation, when present, can identify an authenticator’s make and model through an AAGUID and vendor certificate. He says it does not reveal the user’s operating system, browser, extensions or firmware version.
Are TOTP codes unsafe?
TOTP codes are an added layer beyond passwords, but they can be entered into a phishing site and relayed to the real service, according to Helme. Passkeys are designed to resist that type of attack by being bound to the site’s domain.
Does Helme say hardware security keys are a bad choice?
No. Helme says he recommends YubiKeys to people who want them. He notes that these keys support attestation, so he does not view them as a way to avoid attestation concerns.
What does Helme recommend users do?
He recommends using passkeys where available and storing them with a trusted password or passkey manager. He says users should push back if consumer services begin requiring attestation, but says that has not happened in the situation described in his report.
Source: hn
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
