OPEN LINK ↗
// 1h agoNEWS
Passkeys Get Defense Against Viral Trap Claim
Scott Helme rebuts claims that passkeys enable platform lock-in, arguing that consumer passkeys generally provide no attestation and that WebAuthn attestation does not reveal a user’s operating system or browser. He says abandoning passkeys for TOTP sacrifices phishing resistance. [Source](https://scotthelme.co.uk/passkeys-are-not-a-trap/)
// ANALYSIS
Helme’s rebuttal is persuasive: the original critique identifies legitimate governance risks but stretches hypothetical misuse into present-day advice.
- –Synced passkeys from Apple, Google, Bitwarden, and 1Password typically return no attestation
- –WebAuthn attestation identifies an authenticator model, not arbitrary OS, browser, firmware, or extension details
- –TOTP remains vulnerable to real-time phishing and session theft, while passkeys are origin-bound
- –The stronger practical advice is to use passkeys with a trusted manager while continuing to challenge vendor lock-in
- –Hacker News discussion reflects the real trade-off: passkeys improve security today, but portability and recovery still need better user control [Discussion](https://news.ycombinator.com/item?id=50048312)
// TAGS
passkeyssecuritysafetyapiethics
DISCOVERED
1h ago
2026-10-14
PUBLISHED
2h ago
2026-10-14
RELEVANCE
5/ 10
AUTHOR
speckx