Passkeys are not a trap
- ID
- 35467
- Status
- summarized
- Published
- 14 Oct 2026, 11:15 PM
- Fetched
- 15 Oct 2026, 2:16 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://scotthelme.co.uk/passkeys-are-not-a-trap/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 15 Oct 2026, 2:16 AM
- Tags
- Audience
- developerssaas_foundersvibe_coders
What happened
Scott Helme rebuts a viral 'Passkeys are a trap' post that advised non-technical users to abandon passkeys for TOTP/passwords, arguing its central attestation claim misstates how WebAuthn works. Synced passkeys in iCloud Keychain, Google Password Manager, 1Password, and Bitwarden return no attestation, and consumer-site guidance has been not to request it for years; when attestation is present, it identifies the authenticator's make/model via AAGUID and a vendor certificate chain, not OS, browser, extensions, root/jailbreak, or firmware. He also notes the post recommends YubiKeys as avoiding OS-wide attestation even though YubiKeys ship with Yubico-issued attestation certificates.
Why it matters
If you run a consumer login flow, don't block synced passkeys over an attestation fear: a site that accepts only attested passkeys would instantly lock out most users because common passkey managers return none. Use attestation only where you have a clear enterprise or managed-device requirement, and if you recommend YubiKeys as an attestation-free option, correct that premise because they are attesting authenticators.
Discussion angle
Where does WebAuthn attestation actually belong—enterprise managed devices or consumer logins—and what breaks if a consumer SaaS tries to require it?