Security researcher Scott Helme has challenged a widely circulated argument that passkeys should be avoided because websites can use them to restrict users to approved devices and software. His response centres on how WebAuthn attestation works and on the difference between synced consumer passkeys and hardware authenticators used in managed environments.
Helme says the passkeys most consumers store in services such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden generally provide no attestation statement to a website. A site can request attestation, but a synced passkey normally returns none. A consumer service that insisted on attested credentials would therefore risk excluding most existing passkey users, making such a policy commercially and operationally difficult.
When attestation is available, Helme says it identifies the authenticator's make and model through an AAGUID and can include a certificate chain from its vendor. It does not, in his account, reveal the user's operating system, browser extensions, firmware version, or whether a phone has been modified. This is narrower than the claim that attestation proves an entire approved software environment.
Hardware security keys complicate the criticism further. Devices such as YubiKeys can ship with vendor attestation certificates, and enterprise attestation exists so organisations can require approved hardware. Hardware keys remain a strong security option, but recommending one as a way to escape attestation reverses the technical relationship described in the warning Helme addressed.
The larger security case for passkeys is phishing resistance. A passkey is bound to the internet domain for which it was created. A lookalike site cannot simply persuade a user to type in a reusable secret. Time-based one-time passwords improve on passwords alone, but users can still enter both password and code into a phishing proxy, which may relay them to the genuine service and capture the resulting session.
That does not settle every policy concern. Organisations can impose hardware requirements in managed settings, providers differ in how easily credentials can be moved, and future attempts to expand attestation in consumer services would deserve scrutiny. Users must also choose a passkey manager they trust and understand its recovery and export options.
Helme's conclusion is that those concerns do not justify abandoning passkeys today. On the implementation he describes, mainstream synced passkeys do not hand websites a detailed report about the user's device, while their domain binding removes a common path for account theft. The relevant choice is therefore between current authentication risks, not between a flawless system and a dangerous one.
