TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Scott Helme has challenged a widely shared post urging people to stop using passkeys, saying its account of passkey attestation is misleading. He says ordinary synced passkeys do not provide websites with attestation data, while passkeys’ domain binding makes them more resistant to phishing than TOTP codes.
Security researcher Scott Helme has disputed a widely shared warning that passkeys could let websites require approved devices and software, arguing that the claim overstates what passkey attestation reveals. Helme says most consumer passkeys are synced credentials that do not return attestation data to websites, while passkeys offer stronger protection against phishing than passwords combined with one-time codes.
The article Helme is responding to, titled “Passkeys are a trap. Do not use them.”, argues that websites could use attestation to verify how a passkey was created, then gradually require approved passkey managers, operating systems or other device conditions. It recommends returning to passwords and TOTP codes, which generate time-limited login codes.
Helme says that account of attestation is inaccurate. He describes attestation as information that, when supplied, can identify an authenticator’s make and model through an AAGUID and a vendor certificate chain. He says it does not identify a user’s operating system, browser, extensions, whether a phone is rooted or jailbroken, or its firmware version.
According to Helme, passkeys synced through services such as iCloud Keychain, Google Password Manager, 1Password and Bitwarden do not provide websites with an attestation statement. A website can request attestation, he says, but these credentials return none. He also says consumer-site guidance has advised against requesting attestation for years. These points are Helme’s technical assessment; the source material does not include an independent response from the author of the warning.
Why Phishing Resistance Matters
The practical dispute is about the trade-off between a speculative concern and a current account-security risk. Helme says TOTP codes can be phished: a user may enter a password and code into a convincing fake site, and a real-time relay can pass both to the genuine service. Passkeys are tied to the website domain where they were registered, so a browser should not use a credential for a lookalike domain.
That distinction matters because recommending people abandon passkeys could lead them back to a login method that is more vulnerable to phishing. Helme does not argue that passkeys solve every security problem. Rather, he says their domain binding addresses a common weakness in passwords and TOTP, and that concerns about attestation should be weighed against the protections passkeys provide now.
Passkeys also affect user choice over credential storage. Helme advises using a provider users trust and, for those who want portability, choosing one that supports moving credentials. The source does not compare specific providers or describe the portability options available across them.
As an affiliate, we earn on qualifying purchases.
How Attestation Fits In
The disagreement centers on WebAuthn attestation, an optional part of the technology used by passkeys. Helme’s account distinguishes attestation from a general inspection of a device: when present, he says, it identifies an authenticator model, not the full state of the computer or phone using it.
Helme also challenges the opposing post’s recommendation of a YubiKey as a way to avoid attestation. He says YubiKeys have vendor-issued attestation certificates and that enterprise attestation can let organisations require approved hardware keys. He still recommends hardware security keys to people who want them, but argues that they are not a way to avoid attestation as a category.
Helme says that a consumer site requiring attested passkeys would exclude nearly all users of synced passkeys. He presents that as a practical reason such a policy would be unlikely, not as proof that no service could adopt it. His article also says the largest providers do not support attestation for these consumer passkeys, though it does not list providers or give a date-specific survey.
““These passkeys don’t give websites an attestation statement at all.””
— Scott Helme
As an affiliate, we earn on qualifying purchases.
What Attestation Could Mean Later
The source material does not establish whether any consumer website currently requires attested passkeys, or provide a survey of how widely attestation is used. Helme says consumer guidance has long discouraged requesting it and that common synced passkeys return no attestation, but those assertions are not accompanied here by independent documentation or comment from service providers.
It is also unclear whether future changes to standards, providers or website policies could alter what information is available or how it is used. The warning’s prediction that websites might tighten requirements over time is a concern about possible future policy; Helme says that scenario has not occurred in the consumer passkey use he describes. The source does not identify a specific planned policy change.
The opposing post’s author is not quoted in Helme’s rebuttal material, and the original post’s full evidence is not supplied. Readers therefore have Helme’s technical response, but not a direct reply from the author whose claims he disputes.
As an affiliate, we earn on qualifying purchases.
Choosing a Login Method
Helme’s recommendation is to use passkeys where websites offer them, select a storage provider users trust and check whether it supports credential portability if moving credentials matters to them. He says people concerned about attestation should push back if consumer services begin requiring it, while arguing that avoiding passkeys now does not protect users from the future scenario described in the warning.
No policy change or formal review is announced in the source material. The immediate next step for readers is to assess the security method a service offers and distinguish the current behavior Helme describes from predictions about how websites might use attestation later.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the dispute about?
A widely shared article says passkey attestation could let websites demand approved devices or software and advises users to return to passwords and TOTP codes. Scott Helme disputes that account, saying ordinary synced passkeys do not provide websites with attestation data.
What does passkey attestation reveal, according to Helme?
Helme says attestation, when present, can identify an authenticator’s make and model. He says it does not reveal the operating system, browser, extensions, or whether a phone is rooted or jailbroken.
Why does Helme prefer passkeys to TOTP codes?
He says TOTP codes can be entered into fake sites and relayed to real services. Passkeys are bound to the site’s domain, which helps prevent their use on phishing lookalikes.
Does Helme say hardware security keys are unsafe?
No. Helme says he recommends YubiKeys to people who want them. His point is that these keys can use attestation, so they do not avoid attestation concerns by definition.
Should users stop using passkeys?
Helme advises continuing to use passkeys where available and storing them with a trusted provider. Whether to use a particular service or provider depends on users’ needs, including whether they want credential portability.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
