Passkeys Are Not a Trap

A viral article claims passkeys are a trap that will enable websites to restrict logins to approved devices and software, but this misrepresents how passkeys actually work. The author debunks the central claim by explaining that most consumer passkeys (stored in iCloud Keychain, Google Password Manager, etc.) don't provide attestation to websites at all, and attestation itself only identifies the authenticator hardware—not the OS, browser, extensions, or device modifications. The post ironically recommends YubiKeys as a safer alternative, despite hardware keys being the authenticators that actually support attestation and enterprise restrictions.