News for hackers. Stuff that matters.

A comment on Passkeys are a trap. Do not use them. Parent comment

Re:Passkeys are a trap. Do not use them by kccqzy on Monday October 12, 2026 @10:48AM (#50057224)
The author is clearly saying that the attestation feature is a trap. Typical consumer-oriented websites don’t use this feature. Therefore it is not a trap for your users. However there is no way for users to know and understand that.
[ Parent | on HN ]
Re:Passkeys are a trap. Do not use them by madeofpalk on Monday October 12, 2026 @12:45PM (#50059085)
No browser or consumer password manager implements attestation. There's no need for users to know something that's simply not relevant for them.
[ Parent | on HN ]
Re:Passkeys are a trap. Do not use them by coldpie on Monday October 12, 2026 @02:01PM (#50060283)
Then remove it from the spec and everyone is happy. I don't trust big tech companies to not use this feature if it is available. They have too much incentive to be the sole gatekeeper for your ability to log in to services.
[ Parent | on HN ]
Re:Passkeys are a trap. Do not use them by high_5 on Wednesday October 14, 2026 @04:31PM (#50094697)
To remove it from the spec you would need to get enought votes in the FIDO alliance workgroups and board and whatnot. That's just politics.
[ Parent | on HN ]
Re:Passkeys are a trap. Do not use them by kccqzy on Monday October 12, 2026 @01:22PM (#50059669)
Not if fear-mongering articles like this become widely circulated and make people believe attestation is widely used.
[ Parent | on HN ]