Look, at best, Passkeys shift your logins from your head to OS-supplied keychain management. Whether they do attestation today or not, they big, industry-wide effort to move away from "what you know" (i.e. username/password) + "what you have" (2FA) towards "platform-authenticates-you-to-website automatically" has both security benefits and lock-in risks.

Maybe it was too strong to say the were a "trap", but it is also too strong to say there is no worries here.

▲

embeng4096 2 hours ago | parent | next [-]

TFA's author has also explicitly precluded the "platform-authenticates-you-to-website automatically" workflow, in a separate blog post [0]:

> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.

[0]: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...

▲

stmw 2 hours ago | parent [-]

Well, they can (and likely will be) used in both modes. Either these things are just a different way of generating a password for a password manager (itself a big target of attacks), or they are a way "to move beyond password with TPM-level security". If it's the former, the security benefits are limited. If it's the latter, the "it's a trap" logic applies at least in part.

	▲	embeng4096 an hour ago \| parent [-]
		> Well, they can (and likely will be) used in both modes. I agree - and that makes me wish that the messaging was more clear from passkey supporters. Some may be genuinely confused and talking about one or the other mode (or not even realize that multiple modes exist), and some may be trying to claim the benefits of one mode while/or handwaving away the tradeoffs of the other mode.

▲

timmyc123 2 hours ago | parent | prev [-]

> OS-supplied keychain management

That is your choice as the user. You can use the default credential manager that is offered out of box, or you can use your own.

https://whatarepasskeys.info

	▲	stmw an hour ago \| parent [-]
		It's notable that several of the claims on that page conflict with the other info in both the OP article and the follow-on. As for choice as the user, it's a choice "for now"... and only for users who understand all of these details (which seems unlikely). Personally, my observation is that if one tries to properly configure 2FA with any major website lately (no, I don't mean AWS console), the level of "your choice" and properly implemented security has actually gotten worse...