← Thursday, October 15, 2026SecurityDeep dive

Most synced passkeys do not provide the attestation feared by critics

scotthelme.co.uk 4 min read Editor score 7/10

The piece challenges claims that passkey attestation lets websites restrict users to approved devices, arguing that synced passkeys generally do not attest in that way. Engineers responsible for authentication can use the explanation to evaluate claims about passkey privacy and deployment.

What

Synced passkeys stored in consumer password managers return no attestation statement to websites.

How

When present, WebAuthn attestation identifies an authenticator’s make and model via AAGUID and a vendor certificate, not its OS, browser or extensions.

Why it matters

Passkeys resist real-time phishing relays that can steal passwords and TOTP codes, so replacing them with TOTP weakens account security.

Read on scotthelme.co.uk → Hacker News · 721 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.