Passkeys are not a trap
Points and comments are a snapshot, not live.
Passkeys are not a trap and remain the best defense against phishing.
Scott Helme rebuts a viral post claiming passkeys are a trap due to attestation. He explains that synced passkeys (iCloud, Google, 1Password) return `none` for attestation, not hardware details. Consumer sites requiring attestation would lock out most users. Attestation only reveals the authenticator's make/model, not OS or extensions. He notes TOTP is phishable via real-time proxies like Evilginx, while passkeys are domain-bound and phishing-resistant. Helme recommends continuing to use passkeys via a trusted provider.
What commenters are saying
The thread splits into two camps. One camp backs Helme, arguing the attestation fear is overblown and that passkeys solve real phishing problems. Another camp cites GitHub issues where KeePassXC maintainers report that relying parties already block authenticators missing attestation, calling this a concrete rather than theoretical threat. Commenters also warn against using employer-sponsored password managers for personal passkeys, though several note that 1Password offers free separate personal accounts with business licenses.