PASSKEYS ARE NOT A TRAP

This is one of the strangest takes on security I’ve seen in a while: passkeys are a trap, do not use them (WTF).

It’s 12 pages and over 4,000 words, an essay mixing real facts with a lot of invalid and odd reasoning. Not everything in it is untrue, which is what makes it slippery. Here are the claims that make up the main bulk of the argument, and why they don’t make sense:

1. “2FA and TOTP are the superior option, and FIDO ignored them.”
TOTP can be phished by relaying the code live. An attacker proxy forwards your password and your six digits to the real site and keeps the session. The 30-second expiry is irrelevant when the attacker uses the code immediately. FIDO’s own U2F predates passkeys and was built to fix exactly this.

2. “Transferable versus non-transferable passkeys.”
A non-exportable hardware credential can’t be moved by definition. It’s a distinction invented to make the catalogue look bigger.

3. “Attestation comes with passkeys whether you want it or not.”
It’s optional. A site asks for it at registration, and browsers gate identifying attestation behind a consent prompt. As far as I know, the synced passkeys most people use offer little or none of it to sites.

4. “Sites will quietly start rejecting non-attested passkeys in staggered waves.”
Attestation is returned once, when the credential is created. A site can’t retroactively demand it from existing passkeys. It would have to force everyone to re-enrol, which is anything but quiet. His own footnote 9 admits sites can’t even check who would pass.

5. “Attestation needs your chip, passkey manager, OS and firmware to all pass.”
That describes Play Integrity and App Attest, which are different mechanisms. WebAuthn attestation identifies the authenticator, not your whole stack. Android key attestation does include boot state, but it describes a key, not what’s installed on your phone.

6. “Attestation lets vendors block encrypted messaging and rival apps.”
It doesn’t inventory your software. Any vendor who wants to gate on device integrity already has Play Integrity and App Attest, and not a single passkey is needed for that.

7. “Attestation lets Google lock out other browsers and extensions like uBlock Origin.”
WebAuthn doesn’t attest the browser. The uBlock Origin removal was a Manifest V3 decision with nothing to do with authentication.

8. “A YubiKey avoids the attestation problem because it’s self-contained.”
A YubiKey in FIDO mode is a WebAuthn authenticator. It’s exactly the kind of device an allowlist would admit. If attestation is the threat, the recommendation doesn’t avoid it.

9. “So don’t use passkeys. Use TOTP.”
The conclusion is to prefer passwords and TOTP, which are phishable, over passkeys, which resist phishing through domain binding. For the non-technical audience he’s writing for, the real alternative is a reused password with SMS as the second factor.

Underneath it all, the objection is distrust of the FIDO Alliance, distrust of service providers, and loss of control. But a service has always decided who gets in. It can disable your account, set password rules and force MFA. Choosing which authenticators it accepts is the same kind of decision, and it concerns their service, not your device. He even tells readers to put on a tinfoil hat.

The lock-in worry is fine to have, there are potential risks with implementation with some providers (but that’s always true whenever you use a third party service!). “Don’t use passkeys” is the wrong conclusion, and the essay gives the game away itself. Footnote 13 admits passkeys are domain-bound and resist man-in-the-middle attacks, and the opening concedes they can be far more secure than passwords.

So in short: they even tell you, passkeys are more secure and more convenient.

The more I look at the 12 pages of essay (and god there are footnotes!) the more I just want to block the URL… so so so many words, to self own!

I use passkeys! I broadly believe that without specific requirement statements, I’d say: default to passkeys! Are they perfect? No, are they better than username and passwords for most things? sure! Do you need to ensure you have a plan for failure scenarios? 100% that’s true of basically everything! We have backups as a concept for a reason!

This was attempt 3 of this response, I decided an essay on an essay is probably not the right approach, drowning in words doesn’t change the facts! Once again, it seems like we spend more time combatting myths than fighting baddies! A strange cyber world we live in!