Passkeys: convenient, phishing-resistant and with a back door called attestation

Summary

The article “Passkeys are a trap” on the Non-Functional blog warns non-technical readers about passkeys, because websites could use remote attestation to dictate which software and operating system you may use. On Hacker News it collected almost 900 points and more than 460 comments on 11 October 2026. The core of the warning is justified, but the article leaves out the biggest advantage of passkeys almost until the end: they cannot be phished.

What passkeys are

A passkey is a key pair based on the FIDO Alliance’s WebAuthn standard. The private key stays with the user; the website only knows the public one. When logging in, the device signs a challenge, and only for exactly the domain the passkey was created for. A fake login page therefore gets nothing usable, unlike with a password or one-time code.

The article rightly shows that “passkey” is not a single thing but a construction kit: copyable or not, stored in hardware or as a file, with or without fingerprint or PIN. Laypeople can hardly tell which variant they are creating.

The real point of contention: attestation

With remote attestation, a website can have it cryptographically verified at registration that the passkey comes from an approved device or password manager. This could be used to reject home-made passkey programs, but also to exclude alternative systems such as Linux, LineageOS or GrapheneOS. The article fears that services will introduce this gradually and inconspicuously once almost all users use passkeys.

This concern is not far-fetched. For Android apps, device integrity checks already often lock out devices with custom firmware, such as banking apps on phones running LineageOS.

Where the article overstates

Attestation only exists when a passkey is registered, not at every login, and browsers then explicitly ask. Apple’s and Google’s synced passkeys provide no attestation at all in practice; consumer services therefore usually do not request it. A service cannot check existing passkeys retroactively; it would have to force a new registration, and that would not go unnoticed.

The recommendation to use TOTP instead is a step backwards in security: one-time codes can be intercepted on fake sites and reused immediately. The claim that the FIDO Alliance deliberately confuses users remains unproven. Hanlon’s razor explains unclear terms more simply than a conspiracy.

What you can do

For most people, passkeys are considerably more secure than passwords with one-time codes. Anyone who wants to keep control should use them deliberately, though: in a portable password manager rather than only in a large platform’s account, with more than one passkey per account and with a fallback for emergencies. Transferring passkeys between providers via the new FIDO formats CXF and CXP has only been partly implemented so far.

Ideas

• Passkeys are bound to the domain and therefore protected against phishing.
• “Passkey” refers to many variants with very different properties.
• Remote attestation lets websites assess the user’s device and software.
• Several passkeys per account replace the copyability of a single one.

Insights

• More security and more control over your own devices can come into conflict.
• A standard is only as open as the options providers actually require.

Facts

• The article appeared on 10 October 2026, followed by the Hacker News discussion on 11 October.
• Attestation is only transmitted when a passkey is registered.
• WebAuthn Level 3 added flags indicating whether a passkey is backed up and synced.

References

• The Hack: Passkeys are a trap. Do not use them. (Non-Functional)
• Hacker News: discussion of “Passkeys are a trap”
• W3C: Web Authentication Level 3
• Corbado: why some platforms do not support attestation

Critique

• The most important security advantage, binding to the domain, is only mentioned in an addendum at the end.
• The recommended alternative, TOTP, is considerably weaker against phishing than a passkey.

Remarks

• The article is published under the pseudonym “The Hack” and is explicitly aimed at non-technical readers.

Recommendations

• Store passkeys in a portable manager such as KeePassXC or Bitwarden if control matters to you.
• Set up at least two passkeys on different devices or keys for important accounts.
• Decline attestation requests in the browser if a service asks for them without an obvious reason.
• Keep a documented recovery path for every important account.

Read the original article →

Search the Web Archive

Links to the original source and the Web Archive open in a new tab.