Scott HelmeScottHelme@infosec.exchange
Oct 14, 2026, 2:53 PMWith a passkey you're not going to become the victim of a phishing attack, with a password and 2fa you can be.
Replies
aeriqueaerique@genart.socialOct 14, 2026, 4:34 PM@ScottHelme @rzeta0 But any reasonable password manager (that you say we should use for our passkeys) will check the domain before filling in the credentials?
argv[-1]argv_minus_one@mastodon.sdf.orgOct 14, 2026, 6:28 PMWith a passkey you get vendor lock-in via remote attestation.
I can be vigilant against phishing. But I can't do anything about my bank/government/etc forcing me to use a proprietary device.
We had this exact same scenario play out 20 years ago, it was barely averted, and apparently a lot of people didn't learn their lesson from that experience.
Passkeys are a trap.
- Scott HelmeScottHelme@infosec.exchangeOct 14, 2026, 7:57 PM
@argv_minus_one @rzeta0 Did you.... not read my blog post?..
Can you point me to a website, right now, where I can go create a passkey that requires attestation?
- argv[-1]argv_minus_one@mastodon.sdf.orgOct 14, 2026, 7:58 PM
eBay, from what I've heard.
But even if it hasn't happened yet, well, operative keyword: “yet”. If it can, it will.
- Scott HelmeScottHelme@infosec.exchangeOct 14, 2026, 8:01 PM
Here is my passkey on ebay, created in 2024, stored in 1Password, which does not support attestation...
- argv[-1]argv_minus_one@mastodon.sdf.orgOct 14, 2026, 8:02 PM
Good to hear, but still, see my second paragraph. Though this state of affairs appears positive, I would consider it temporary.
- Scott HelmeScottHelme@infosec.exchangeOct 14, 2026, 8:32 PM
There's something I'm missing. Why would any site start requiring attestation? What's the perceived benefit to them that you're seeing that would drive that?
- argv[-1]argv_minus_one@mastodon.sdf.orgOct 14, 2026, 9:24 PM
“Security” is the usual excuse.
See, for example, the EUDI Wallet app. It requires a certified proprietary device, for “security” reasons. Even though the credentials it stores are yours and no one else's, it will not run on, for example, a device running /e/OS. Because it's not “secure”.
Obviously there's some ulterior motive at work, but what exactly that is, I don't know. All I know is what the public-facing excuse is, and that it's obviously false.
Oct 14, 2026, 10:19 PM@ScottHelme @argv_minus_one @rzeta0 I read your blog post. You completely failed to address this. You keep talking about what's true today, and refusing to discuss where things are headed.
The actors involved have a very clear playbook, written directly into the standard, for how to - once the technology is widely used - seize control.
alloallo@chaos.socialOct 15, 2026, 1:02 PM@ScottHelme
Isn't plain WebAuthn without any of the additional passkey features enough for this?Pseudonymous, not cross relatable between sites, and bound to domain and username it should be secure and private, and the only remaining annoyance is that losing the key is more likely than forgetting a password.
