Passkeys are not a trap: a rebuttal to the post telling people to drop them

A post titled "Passkeys are a trap. Do not use them." has been circulating for days and climbed high on Hacker News. The author of this rebuttal says friends kept sending it to him with an "is this true?" vibe. The original is written for "non-technical citizens of the web", and its headline advice is to stop using passkeys and go back to TOTP codes and passwords.

The original's central claim, as the rebuttal summarises it, is that passkeys support attestation, which lets a website ask for cryptographic proof of what made the passkey. The original calls this a "hidden dial" that sites will slowly turn up until you can only log in with approved software on an approved operating system: no modifications, no LineageOS, no sharing your Netflix password. It adds uBlock Origin, the FIDO Alliance membership list and the UK's image-scanning proposals, and concludes that passkeys are "not designed to prioritize your interests".

The rebuttal's author says this story is compelling but does not match how any of it works, and makes four points.

First, the passkeys most people use are synced passkeys, held in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or similar software. These give websites no attestation statement at all; a site can ask, but what comes back is none. He says he knows this because he wrote an open-source passkeys library. A consumer site that accepted only attested passkeys would lock out almost all of its own users instantly, and the guidance for consumer sites has been for years not to request attestation at all.

Second, the original says attestation proves "that an approved passkey manager, operating system, and firmware are in use". The rebuttal calls that simply untrue. When attestation is present in WebAuthn, it tells the site the make and model of the authenticator, identified by its AAGUID, backed by a certificate chain from the vendor. It says nothing about your OS, browser, extensions, whether your phone is rooted or jailbroken, your firmware version, "or even what colour it is".

Third, the original recommends a hardware key such as a YubiKey because it "avoids OS-wide attestation". The rebuttal's author finds this the most surprising part: YubiKeys are exactly the authenticators that do attestation. Each ships with a Yubico-issued attestation certificate, and enterprise attestation exists so organisations can require approved hardware keys. He still recommends YubiKeys and uses them, but says that if attestation is your worry, the original's own recommendation pushes you toward it.

Fourth, the original holds up TOTP as a great solution. The rebuttal agrees TOTP beats a password alone but says its big weakness is that you can type the code into the wrong website, and cites Troy Hunt, whom he calls "my good friend", as an example. Phishing kits like Evilginx sit in the middle, relay password and code to the real site in real time, and walk away with the session. He says this is how a huge number of account takeovers happen today. A passkey, by contrast, is bound to the domain it was created for, so the browser will not use an example.com passkey on examp1e.com, and there is no code for the user to get wrong. He notes the original's author concedes in an addendum that passkeys are domain-bound and resist man-in-the-middle attacks, yet still tells readers to avoid them. Swapping a phishing-resistant credential for a phishable one, he writes, is a really bad trade.

His advice: keep using passkeys, take one wherever a site offers it, and store it in a password or passkey manager you trust. If you want to move credentials between services, pick a provider that supports that. If attestation ever creeps into consumer logins, that is worth pushing back on loudly. But it has not happened, the biggest providers do not support it, and avoiding passkeys now while waiting for it protects against nothing and leaves you open to phishing. He closes by listing his experience with passkeys and saying he uses them everywhere he can because they are currently the best thing available to protect accounts.

Key facts

• The original post told non-technical users to abandon passkeys for TOTP codes and passwords, arguing that attestation is a "hidden dial" sites will turn up to force approved software.
• Synced passkeys (iCloud Keychain, Google Password Manager, 1Password, Bitwarden) give sites no attestation statement; a site can ask, but gets none back.
• WebAuthn attestation, when present, reveals only the authenticator's make and model via its AAGUID and a vendor certificate chain, not OS, browser, extensions, rooted state or firmware.
• YubiKeys, which the original recommends, are the authenticators that do attestation, so that advice points toward attestation rather than away from it.
• TOTP can be relayed by phishing kits like Evilginx, while a passkey is bound to its domain and will not work on a lookalike site.

Why it matters

Passkeys are the main replacement for passwords on consumer sites, and a viral post telling ordinary people to abandon them for TOTP and passwords could push them toward a weaker option. The rebuttal addresses the specific fear behind that advice: that attestation will let sites lock users into approved software and hardware. By separating what attestation actually reports from what the original claims, it gives readers a way to judge the lock-in worry on technical facts rather than on a persuasive narrative.

Who it affects

Mainly ordinary web users, the "non-technical citizens of the web" the original post targeted, who are deciding whether to enable passkeys or fall back to TOTP codes and passwords. It also touches people who use synced passkey managers such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden, and organisations that might use enterprise attestation to require approved hardware keys. Consumer website operators are affected too, since the author says guidance for them has long been not to request attestation.

How to use it

The author's advice is plain: keep using passkeys, take one wherever a site offers it, and store it in a password or passkey manager you trust. If you want to be able to move your credentials around, pick a provider that supports that. A YubiKey is still a good choice for anyone who wants one, according to the author, who uses them himself. If you are worried about attestation creeping into consumer logins, he suggests pushing back loudly if it ever happens.

How solid is it

This is a single blog post, an opinion piece with technical argument rather than a study, and it does not name the author of the original post it answers. The author backs his position with his own experience: he lists building and deploying passkeys support at his own SaaS company, a security-reviewed open-source passkeys library, a site tracking passkey availability on the web, and security testing of implementations. His technical points about synced passkeys returning no attestation, AAGUID-based attestation and domain binding are stated directly. The claim that a huge number of account takeovers involve TOTP phishing is asserted, not backed with figures in the post.

Risks and caveats

The rebuttal does not say attestation can never spread. It says that if it creeps into consumer logins that would be worth loud pushback, and that it has not happened so far. The author notes he has openly acknowledged the limitations of not using attestation on passkeys. He also treats TOTP as better than a password alone, so the dispute is about which tradeoff is better for ordinary users, not whether TOTP has any value. Readers who do want to avoid attested hardware should note that, per the author, YubiKeys ship with attestation certificates.

“avoiding passkeys today while you wait for it won't protect you from anything, it just leaves you open to phishing.”

— From the post "Passkeys are not a trap"