Passkeys are not a trap: Scott Helme rebuts the viral attestation argument
Scott Helme rebutted the viral "Passkeys are a trap" essay on Oct 14: synced passkeys return attestation "none", and Evilginx relays TOTP in real time.
On October 14, security researcher Scott Helme, author of the open-source PHP WebAuthn library passkeys-php, published “Passkeys are not a trap,” a point-by-point rebuttal of the viral Substack essay “Passkeys are a trap. Do not use them.” The essay had been posted to Hacker News on October 11 and collected 1,125 points and 574 comments; Apple’s Passkeys lead Ricky Mondello had already called it “a transparent attempt to clumsily string together a conspiracy” on October 12. Helme’s core correction comes from maintaining his own library: synced passkeys return an attestation of “none” even when a site asks for one.
Key points
- Synced passkeys — iCloud Keychain, Google Password Manager, 1Password, Bitwarden — return “none” when a site requests attestation, an observation from Helme’s own passkeys-php work. A consumer site that required attested passkeys would lock out nearly all of its users at once.
- When attestation does exist, the AAGUID exposes only the authenticator’s make and model plus a certificate chain. It reveals nothing about your OS, browser, extensions, firmware version, or root status.
- The YubiKeys the essay recommends as the safe alternative ship with a Yubico attestation certificate out of the box.
Background
On October 10, an author writing as “The Hack” on the Non-Functional Substack argued that passkeys, while technically secure, carry a Trojan horse: remote attestation. The essay likens WebAuthn to “a parts catalogue” and warns that once adoption is high enough, sites could flip a switch, accept only attested credentials, and lock out Linux, LineageOS, and GrapheneOS users — eventually forcing identity checks or content scanners on everyone else. Its advice: stay with passwords plus TOTP, or move to hardware security keys like a YubiKey. The next day it reached Hacker News, and the two camps have been arguing in that thread ever since.
Two details set the terms of this debate. Footnote 8 of the essay concedes its author had mistaken the AT flag in the authenticator data for an attestation indicator, when the flag points at an unrelated concept that happens to share the name. Footnote 9 retracts the earlier claim that platforms could query in advance which users’ devices support remote attestation. Part of what Helme rebuts, in other words, the essay had already retracted itself.
The facts
Helme checked each of the essay’s four core claims against how WebAuthn actually behaves, in his October 14 post:
| Claim in dispute | What the essay says | What Helme found |
|---|---|---|
| Synced passkeys and attestation | Sites can require attestation and gradually exclude users | Synced passkeys return “none” when asked; requiring it would lock out nearly everyone |
| What the AAGUID exposes | Enough to identify and control a user’s device | Make, model, and a certificate chain — no OS, browser, firmware, or root status |
| YubiKeys | A way to avoid OS-level attestation | Every one ships with a Yubico attestation certificate; enterprise attestation exists precisely so companies can mandate approved hardware |
| TOTP and phishing | A “great solution” for adding security to passwords | Evilginx-style kits relay TOTP codes and session cookies in real time — he cites Troy Hunt’s Mailchimp phishing incident; passkeys are bound to a domain and cannot be relayed |
Helme sums up the essay’s advice as a bad trade: swapping a phishing-resistant credential for a phishable one. “It’s a compelling story. It just doesn’t match how any of this actually works,” he writes. Mondello’s post adds the platform side: attestation for syncable consumer credentials runs against the published non-goals of the people who design passkeys, and banks that asked for attestation early in the industry’s passkey journey were held off by platforms, browsers, and credential manager vendors.
What others say
Mondello’s October 12 Mastodon post makes three objections: presenting complicated things as inherently suspicious; calling TOTP “a great solution” when phishing — a word the essay never uses — is the most common threat on the web and TOTP barely helps against it; and stacking logical leaps on a subject the author has not mastered. The post drew 602 boosts and 765 favourites when checked on October 15.
The Hacker News thread on Helme’s post (421 points and 588 comments when checked on October 15) splits less cleanly than the two essays do. Critics point at implementation quality: commenter chaboud estimates about 30% of the sites he has used botch the passkey flow — his own experience, not a survey — and commenter dllu describes Firefox on Linux refusing to show the QR-code flow for an Okta sign-in until the attempt timed out. Defenders point at the model: WorldMaker lists the third-party password manager support and migration paths all three platform vendors now ship by default; dfabulich notes most managers refuse passkey exports and move credentials app-to-app over the Credential Exchange Protocol; OkCompute64 reports years of Bitwarden-synced passkeys across Mac, iOS, Linux, and Android without an incident.
Our take
The debate matters for two groups. Teams building login get a checkable fact: synced passkeys attest “none” today, so requiring attestation means giving up consumer sign-in, and the engineering that pays is multiple passkeys per account, a recovery flow you can explain, and a migration path. Everyone else should know that moving high-value accounts to passkeys still beats passwords plus TOTP against phishing — the setup the essay recommends is the one that gets relayed in real time. Basic credential hygiene survives the whole argument untouched: Shopify’s Any Agent shopping terms tell buyers flatly not to hand a passkey or a one-time code to an agent (see our earlier entry on Shopify’s Any Agent terms).
Two open problems deserve more attention than the conspiracy reading: cross-device sign-in is still fragmented, judging by the failure stories on HN, and syncable-key export stays unsettled — Bitwarden lets you export, most managers don’t. The “sites will flip attestation on later” scenario is held off for now by public commitments from the people building the standard and by the platforms’ refusal. That is a promise, with no technical barrier behind it, and worth watching.