Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.
The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.
I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.
@ScottHelme thanks for that. i saw the other post going roundyround and got tinfoil feelings reading it :D
Oct 14, 2026, 2:12 PM@ScottHelme Overall I agree but I am unsure if the key statement is true in every case:
> The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.
At least for Android I think this might be untrue in certain although rare situations (though very unlikely, as it only works for device bound ones).
As per this press release - https://android-developers.googleblog.com/2024/09/attestation-format-change-for-android-fido2-api.html?m=1 - the attestation for such keys is based on https://source.android.com/docs/security/features/keystore/attestation . And this includes OS, vendor and patch versions.
I am also unsure what the TPM attestation when using Windows Hello includes and attests
For device bound credentials on Apple devices there is also something similar, but this seems to be connected to MDM scenarios (so passkey usage might be mandated by an employer anyway, therefore any discussion about a choice in that situation is pointless).
All of this seems to be a very edge cases that should not stop anyone to use passkeys.
@varbin I think the main thing is that none of this is required to use passkeys on any website that I've seen.
Oct 14, 2026, 2:35 PM@ScottHelme I fully agree to that.
They're still annoying as fuck. Esp. on sites like ebay or Microsoft...
@ScottHelme No one mentions that TOTP completely failed at doing what it was designed that it’s not phishing resistant
Oct 14, 2026, 6:03 PM@plaka @ScottHelme Yup. TOTPs are a hack to effectively create unique passwords. It's hard to enforce unique passwords by policy, so instead we let users chose their own passwords and add a computer generated TOTP to it s.t. password stuffing won't work anymore. But phishing? Nope, TOTPs won't help you much there.
Maybe you can elaborate on this, which does seem to be over-generalizing:
»When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.«
Apples elaborate mechanism, in a nutshell, seems to be "We'll check the security enclave has a unique key for you, and you will believe us because we guarantee everything is ok with our own unique, global AAGUID."
Their AAGUID just stands for "Apple", no model /make series at all, correct?
Since trust in Apple is required here, this seems to imply that there is some form of an essentially software-based attestation process.
In case I am severely mistaken, I'd be very thankful for a decisive clue where I am going astray here.
Apple Passwords does not support any form of passkey attestation on consumer unmanaged devices. The A in AAGUID is for authenticator.
@timcappalli @katzenberger agreed, I think a couple of features are being conflated here.
Thank you for weighing in. I feel that I am currently not able to explain my point more concisely (device management for enterprises by Apple was not what I am worried about, as it's irrelevant for mass-market "solutions"), so I need some time to better pin that point down.
Here is IMH better argument against passkeys for personal use: https://hawksley.dev/blog/i-dont-like-passkeys
To summarize: perfect fit for a corporate environment, but a poor fit for personal security.
"To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts."
"If their [Apple and Google] automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too."
"I believe enterprise users have good reason to use passkeys, but the ecosystem isn’t mature enough yet for individuals."
@maxpool Those are fair arguments, and points we could discuss.
It's worth noting though that the same problem exists if you store your passwords or passkeys in keychain and then lose your Apple account, you have the exact same recovery issue.
These are also not the points or concerns raised in the OP, which I believe don't stand up to scrutiny.
That's why the proposal: "third-party password manager, paired with an independent TOTP app" seems like the the best solution for personal use until passkeys have mature ecosystem.
Authentication is decoupled from OS vendor. Password vault and TOTP tokens exist independently. Even if Apple or Google bans your identity, you keep your credentials, can log in from any browser or OS, and can update your contact email on those third-party services.
I'm no expert, but if I understand the situation correctly, FIDO alliance has draft for transferring passkeys between ecosystems (Apple, Android, Google, Linux,... ) but it does not exist in practice.
It's probably just an attempt in lock-in to slow walk, or refuse to implement these parts.
@maxpool Right, but all I'm saying is you need to swap "password and TOTP" with "passkey" in that explanation and you're better off.
If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?
All password managers I've seen can sync passkeys across any device where the password manager is installed.
this is one of the primary reasons whatarepasskeys.info was created: to help users find a credential manager that works for them and help them understand passkeys more generally.
@timcappalli @ScottHelme @maxpool
> If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?
I can export my passwords out of Google Password Manager into a CSV. I can open it in a text editor and see my passwords in there. But I can't export passkeys the same way. I understand that the Credential Exchange Protocol is a thing and can use the flow to import them into Bitwarden or whatever but I prefer a little less opaqueness.
do you think that is appropriate for an elderly parent who can be easily tricked into exporting all their passkeys in plain text and uploading them to an attacker's site?
If plaintext export is something you want, there are credential managers which will give you that. Use them. But I don't think that's appropriate for the majority of consumers.
Oct 14, 2026, 5:22 PM@timcappalli @juancnuno @ScottHelme @maxpool counterpoint -> my mom finds password managers difficult enough to use already, and she prefers something she understands.
sure, but she's probably already using one without realizing it, because a majority of users prefer to have their trusted devices remember things for them.
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool The older users I know are still using pieces of paper (or worse, an excel file!) to manage their passwords. Even TOTP is beyond at least some of them. SMS-based 2FA is frustrating to them but they have at least learned what they're expected to do.
For a certain age group, change - any change at all - is really, really difficult to cope with. It's confusing, and ultimately pushes them to reject technology. Then they feel isolated because so many things assume some level of online capability.
@GerardThornley @amonduin @juancnuno @ScottHelme @maxpool they're also the folks most at risk of being phished and losing their retirement. we have to try!
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool Oh, I appreciate the risks arrayed against them. But if folks are struggling to cope with what they already have, the right solution is not asking them to learn something new.
I think for some people it might be better to move their interface to services offline - support people living in a simpler world.
@timcappalli @juancnuno @ScottHelme @maxpool Actually, if we're bringing up elderly (grand)parents, this introduces a new concern AGAINST passkeys.
Grandma IS going to do something dumb. I AM going to need to sign in to her accounts on my own devices. I AM going to need to fix hr accounts.My mom IS needing to take over her finances to get her bills paid.
Sure, grandma may not be able to handle a plaintext export, but as de-facto tech support? I'm going to find that feature invaluble.
@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool you can also run into issue with shared accounts to spouse/partner. I don't move some of the shopping accounts we use to them because for reasonable reasons my wife doesn't want the extra hoops of another app or having to find a specific device to okay it. Not when if it sends me mfa code I can rattle it off to her and she's just slightly inconvenienced but logged in.
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool The moment you stop assuming an account can only be accessed by one person on devices they fully control, the entire problem of authentication changes dramaticallly.
most credential managers offer family passkey sharing specifically to address this case!
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Sure sure...
Grandma has an Apple and Mom and I do not. Mom struggles with the password manager I use regularly.
Now how do Mom and I step in and help Grandma under the passkey system?
@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool I'm guessing she relies on Apples app for hers?
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool She has an odd combination of Apple's app (sign in with Face ID) and data stored in... i think her phone book?
Neither is particularly intentionally managed...
@Epic_Null @ppb1701 @juancnuno @ScottHelme @maxpool you can choose a credential manager that works on all platforms, and set it up for her. It's exactly what I've done with my parents!
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Yeaaaaaaaaaaaaaah I have met my grandma and on a scale of 1 to 10 the probability of that happening is a -50. As in somehow it would create a different, worse crisis if I tried to do that.
As for my mom, I have learned that the things that make me happy with a password manager are non-starters for her.
We have different needs and getting us on the same password manager is gonna be a "no".
@timcappalli @Epic_Null @juancnuno @ScottHelme @maxpool yep, but that's if you can get the family to use "yet another" app. Does work but there is a bit of an if there.
@ppb1701 @Epic_Null @juancnuno @ScottHelme @maxpool sure. that's the case in many parts of life.
@maxpool @ScottHelme Ultimately if a passkey goes away your fallbacks are passwords and reset-by-email, right? And those are your fallbacks now? So if you use passkeys for a few years and then the site betrays you like this, then the net gain is at least you had a few years of easier/safer/unphishable logins and a future of logging into that site without passkeys (or moving to a site that hasn’t betrayed you). Seems like even your worst case is a limited gain but net gain. Did I miss something?
Oct 14, 2026, 5:00 PM@chazh @maxpool @ScottHelme it also relies on a fundamental misunderstanding of how even the platform passkeys work. If you use Apple’s iCloud Keychain and then get added to a terrorist watchlist, it will block your ability to make changes but it doesn’t remote wipe all of your devices.
Even if that was true, the answer would be using a password manager not made by the OS vendor or buying a Yubikey, not getting phished because you think this much rarer event was your greatest threat.
Oct 14, 2026, 6:49 PM@acdha @chazh @maxpool @ScottHelme It doesn't matter if it remote wipes you or not it depends on whether or not Apple can reach out and lock your account. If the iCloud Keychain gets locked and you can't log into it anymore you're just as stuck as if you the vault was wiped.
There are ways of doing it (offline first models) that do sync and do not support this kind of lockout but that isn't the default for most of the popular solutions. (Note that this is a password manager problem more generally not just passkeys)
Oct 14, 2026, 7:14 PM@amonduin @chazh @maxpool @ScottHelme My point was that it's not true: if your iCloud account is locked or unavailable, you can still use your local copy — it won't sync any more but you can migrate as you want to anything else, including exporting your passkeys to something like BitWarden, 1P, etc.
Oct 14, 2026, 7:31 PM@acdha @chazh @maxpool @ScottHelme is that true though? If my iCloud account is locked do I still have access to the iCloud vault? I know with bitwarden and proton pass because you log into the app with your account if your account login fails you are at risk of being unable to access your passkeys. I haven’t checked if iCloud Keychain is similar where if the authentication shows as locked or terminated account the keychain still unlocks.
@amonduin @acdha @maxpool @ScottHelme As far as Iknow, anything you can reach by way of a PIN or FaceID or TouchID or a local MacOS password is running locally and hasn’t gone and checked with Apple. Anything you need to type your Apple Account password into, on the other hand, is at risk. Want to mitigate the risk anyway, go for it, make backups. Want to have less Apple risk, use somebody else’s passkeys system.
@amonduin @acdha @maxpool @ScottHelme Yeah, that’s an argument against using Apple, not against using passkeys. Fine, pick a different one, and/or maintain backups under your control.
Oct 14, 2026, 7:33 PM@chazh @acdha @maxpool @ScottHelme this is an argument against the system because as designed it doesn’t guarantee user ownership and access. The standard should explicitly be against things like device fingerprinting and attestation and require that users have access to passkeys even if the sync account is locked, that it does not is a mark against passkeys as a concept and standard.
@amonduin @acdha @maxpool @ScottHelme Exported backups guarantee access, right? What am I missing?
*edit* If this is about attestation, I have to ask if you read Scott’s original post regarding why that is not a real threat?
Passkeys are an utterly unnecessary solution for corporate environments, because corporate environments already have PKCS#11, and have had it for 30 years.
So no, passkeys are not good for corporate *or* personal use.
@argv_minus_one @maxpool @ScottHelme fuckin hitech act
I mean, if you want security then you want it to be battle-tested, and it doesn't get much more battle-tested than PKCS#11. That s**t works.
It also doesn't require any nonsense about remote attestation, because the company's IT department controls which devices the private keys go onto in the first place. Hardware token? Secure enclave on a phone? Doesn't matter, as long as there's a PKCS#11 driver for it.
@argv_minus_one @autolycos @maxpool @ScottHelme agreed for corporate identity mgmt you can’t beat certificates; 90% of users love the idea of letting AppleID handle it all, but #lock-in is undeniable. When their phone dies, they will not buy a google or other type of phone, even if technically possible the #FRICTION is increased by passkeys.
If anyone has the patience could they explain in plain simple English what the benefit of a passkey are over simple password, and 2fa where justified.
I'm adverse to
1. An overly vendor or consortium of vendor standards
2. Someone else, especially an unknown unvetted 3rd party, managing all/most of my credentials
With a passkey you're not going to become the victim of a phishing attack, with a password and 2fa you can be.
@ScottHelme @rzeta0 But any reasonable password manager (that you say we should use for our passkeys) will check the domain before filling in the credentials?
With a passkey you get vendor lock-in via remote attestation.
I can be vigilant against phishing. But I can't do anything about my bank/government/etc forcing me to use a proprietary device.
We had this exact same scenario play out 20 years ago, it was barely averted, and apparently a lot of people didn't learn their lesson from that experience.
Passkeys are a trap.
@argv_minus_one @rzeta0 Did you.... not read my blog post?..
Can you point me to a website, right now, where I can go create a passkey that requires attestation?
eBay, from what I've heard.
But even if it hasn't happened yet, well, operative keyword: “yet”. If it can, it will.
Here is my passkey on ebay, created in 2024, stored in 1Password, which does not support attestation...
Good to hear, but still, see my second paragraph. Though this state of affairs appears positive, I would consider it temporary.
There's something I'm missing. Why would any site start requiring attestation? What's the perceived benefit to them that you're seeing that would drive that?
“Security” is the usual excuse.
See, for example, the EUDI Wallet app. It requires a certified proprietary device, for “security” reasons. Even though the credentials it stores are yours and no one else's, it will not run on, for example, a device running /e/OS. Because it's not “secure”.
Obviously there's some ulterior motive at work, but what exactly that is, I don't know. All I know is what the public-facing excuse is, and that it's obviously false.
Oct 14, 2026, 10:19 PM@ScottHelme @argv_minus_one @rzeta0 I read your blog post. You completely failed to address this. You keep talking about what's true today, and refusing to discuss where things are headed.
The actors involved have a very clear playbook, written directly into the standard, for how to - once the technology is widely used - seize control.
@ScottHelme
Isn't plain WebAuthn without any of the additional passkey features enough for this?
Pseudonymous, not cross relatable between sites, and bound to domain and username it should be secure and private, and the only remaining annoyance is that losing the key is more likely than forgetting a password.
@rzeta0 @ScottHelme With a password, both you and the server you are logging into have a copy of your full password and possibly the seed for your 2FA. If that server is compromised, or you click on a phishing link and hand those credentials over to a hacker, your account can be compromised.
With a passkey, you have half of your pass (private key), the server has the other half (public key). Only when they are together do they let you in and only on the website they were created on.