Passkeys Are Not a Trap
A security expert refutes claims that passkeys are a 'trap' designed to restrict user freedom through attestation. The author argues that passkeys are a secure, user-friendly evolution of authentication that does not inherently enable vendor lock-in.
Why it matters
As the industry shifts toward passwordless authentication, understanding the security and privacy implications of passkeys is essential for digital safety.
Security researcher, entrepreneur and international speaker who specialises in web technologies.
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for "non-technical citizens of the web", and the headline advice is to stop using passkeys and go back to TOTP codes and passwords.
The post makes what appears to be one central claim: Passkeys support something called attestation, which lets a website ask for cryptographic proof of what made the passkey.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in