A recent blog post titled “Passkeys are a trap. Do not use them.” has circulated on Hacker News and been shared widely, urging readers to abandon passkeys in favor of TOTP codes and traditional passwords. The author, Scott Helme, argues that the central claim of the post is that passkeys support attestation, which he describes as a hidden dial that websites could turn up to force users onto approved software and operating systems, eliminating the ability to use modified OSes, custom firmware, or share passwords. According to the post, this would allow sites to demand cryptographic proof of what created the passkey, ultimately prioritizing their own interests over users’.
Helme counters that the passkeys most people actually use are synced passkeys stored in services such as iCloud Keychain, Google Password Manager, 1Password, Bitwarden or similar password managers. He notes that these synced passkeys do not provide an attestation statement when a website requests it; the response is effectively none. This observation comes from his own experience creating an open‑source passkeys library and testing its behavior. He points out that if a consumer site suddenly required attested passkeys, it would lock out the vast majority of its users, making such a move unlikely. Furthermore, he says that guidance for consumer sites has long been to avoid requesting attestation altogether.
Regarding what attestation actually does, Helme explains that when it is present, WebAuthn attestation reveals only the make and model of the authenticator, identified by its AAGUID, backed by a vendor‑issued certificate chain. It does not disclose the operating system, browser, extensions, whether the device is rooted or jailbroken, firmware version, or any other personal details. The post’s characterization of attestation as proof of an approved passkey manager, OS, and firmware is therefore inaccurate.
He also addresses the post’s recommendation to use a hardware security key such as a YubiKey for stronger security. Helme acknowledges that YubiKeys do ship with attestation certificates and that enterprise attestation exists precisely so organizations can require approved hardware keys. However, he notes that recommending a YubiKey because it “avoids OS‑wide attestation” actually points users toward a device that does provide attestation, contradicting the post’s own warning.
On the topic of TOTP, Helme agrees that it is stronger than a password alone but highlights its susceptibility to phishing. He cites real‑world tools like Evilginx that relay passwords and one‑time codes to the legitimate site, enabling account takeover. Passkeys, by contrast, are bound to the exact domain for which they were created, preventing the browser from using a passkey on a look‑alike site and eliminating the need for users to read or type a code. Even though the post’s addendum concedes that passkeys resist man‑in‑the‑middle attacks, it still advises against them, a trade Helme describes as swapping a phishing‑resistant credential for a phishable one.
Finally, Helme advises readers to continue using passkeys wherever offered, storing them in a trusted password or passkey manager, and to choose providers that support credential portability if desired. He suggests that concerns about attestation creeping into consumer logins are worth monitoring and pushing back on should they arise, but emphasizes that such a shift has not occurred, major providers do not currently support consumer attestation, and abandoning passkeys today only leaves users exposed to phishing risks.