"Passkeys are a trap," and a security researcher's reply
Both sides of a debate many readers will meet when a site asks them to switch.
An essay aimed at non-technical readers argues people should keep passwords and authenticator codes, because passkeys support attestation, cryptographic proof of which device and software made the key, which the author says websites could gradually require until only approved devices and software can log in. Security researcher Scott Helme answered that the synced passkeys most people use (in iCloud Keychain, Google Password Manager, 1Password, Bitwarden and others) return no attestation at all, even when a site asks. Both posts drew long Hacker News discussions.
-
WebAuthn
After exploring Passkeys are a trap. Do not use them., the standard underneath passkeys is WebAuthn.
The W3C web standard for logging in with digital signatures instead of passwords, which most sites still pair with passwords in some way.
Wikipedia · Swim · 30 min
0