Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.

The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.

I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.

https://scotthelme.co.uk/passkeys-are-not-a-trap/