A widely shared Hacker News post claims passkeys are a trap and urges non-technical users to return to TOTP codes and passwords. The post argues that passkey attestation lets websites demand approved software, operating systems and hardware, eventually locking users out of modifications and shared accounts.
The author of the rebuttal, who wrote an open-source passkeys library, says this misunderstands how things work. Synced passkeys stored in iCloud Keychain, Google Password Manager, 1Password or Bitwarden do not provide attestation at all, and a consumer site requiring attested passkeys would lock out nearly all of its own users. Attestation, where present, only identifies the make and model of an authenticator via its AAGUID and vendor certificate chain. It says nothing about the operating system, browser, extensions or firmware.
The post also recommends hardware keys like a Yubi Key to avoid attestation, yet Yubi Keys are the very devices that perform it. Meanwhile, the post praises TOTP, which remains vulnerable to phishing kits such as Evilginx that relay codes to the real site in real time. Passkeys are bound to their domain, so a credential created for example.com will not work on a lookalike site.
The verdict is clear: swapping a phishing-resistant credential for a phishable one is a poor trade. Users are advised to keep using passkeys wherever sites support them.
Source: Hacker News · Summarized by HeadlinesBriefing