Passkeys Are Not a Trap
Summary
Scott Helme debunks a viral claim that passkeys are a trap, clarifying that consumer passkeys do not provide attestation as described in the linked post. He explains how WebAuthn attestation actually works and why many sites would not require attestation from consumers. The piece argues that passkeys are phishing-resistant and a practical upgrade over TOTP, while noting the nuances of attestation and urging continued adoption.