By ByteBot
Passkeys solve phishing. That part is true, and worth saying clearly before what comes next. When a credential is cryptographically bound to an exact domain, lookalike sites get nothing—full stop. But buried inside the WebAuthn standard that powers passkeys is a feature called remote attestation, and it has nothing to do with your security. It has everything to do with who gets to decide which software you’re allowed to run.
What Remote Attestation Actually Does in WebAuthn
Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list. If they aren’t—if you’re running a custom Android ROM, a Linux desktop with an open-source password manager, or anything outside the platform-approved stack—you can be denied access. Not because you pose a threat. Because you’re running unapproved software.
This is already happening. The Austrian government requires citizens to use whitelisted hardware tokens to access tax records and medical data. Open-source authenticators are simply rejected. The argument from implementers is that attestation improves security assurance. The argument from everyone else is that a government is now telling you which software company you’re allowed to buy from to log into your own public services.
The Mobile Precedent Is Not Hypothetical
Google’s Play Integrity API already enforces this on Android. Banking apps routinely block rooted phones and unlocked bootloaders—not because those devices are compromised, but because they’re outside the approved configuration. The apps don’t know whether your device is secure. They just know it’s non-standard, so they refuse. If that feels like an acceptable trade-off for banking, consider whether you want the same logic applied to your government identity portal, your workplace login, or eventually your email provider.
Enterprise security teams are already adding “require passkey attestation” to their checklists. This isn’t speculation—attestation products actively pitch “governed passkeys” to enterprise IT as a zero-trust control mechanism. The trajectory from optional to standard to mandatory is exactly how browser APIs have worked for every feature the ad industry needed normalized.
Related: GhostAction Mines Git History — 500 GitHub Accounts Hijacked
The FIDO Alliance Helped Bury This Distinction
The FIDO Alliance uses “passkey” as an umbrella term for more than a dozen different credential variants with meaningfully different security properties. Synced passkeys—the kind in iCloud Keychain, Google Password Manager, or 1Password—cannot carry attestation by design, because the private key copies to the cloud. Device-bound passkeys on a YubiKey or a TPM-backed Windows Hello credential can carry attestation. Same name. Radically different behavior. The Alliance chose this branding deliberately, as the community debate on Lobste.rs makes clear.
The practical result: most users cannot consent to remote attestation because they don’t know it exists. When a service announces “we now support passkeys,” there is no disclosure about whether attestation is required, what software qualifies, or what happens to users running non-standard configurations. The opacity is a feature of the rollout, not a bug.
The 2026 Attack Research Shows Infrastructure Is the Real Weakness
Three independent research teams presented passkey bypass techniques at Black Hat USA 2026, and none broke FIDO2 cryptography. SpecterOps found that Windows logged WebAuthn assertions in cleartext event logs, and Microsoft Entra ID accepted replay of those assertions (CVE-2026-34348, CVSS 6.5, patched July 2026). Unit 42 extracted Chrome’s 32-byte sync domain secret during re-registration—which unlocks all synced passkey private keys permanently, with no revocation mechanism. Mollema demonstrated that low-privilege Windows code could invoke Windows Hello keys without fresh biometric verification.
The common thread: passkeys shifted the attack surface from remote phishing to local endpoint compromise. That is a genuine improvement. However, sync convenience—the feature that makes passkeys usable across devices—introduced new custody attack vectors that didn’t exist with device-bound credentials. As The Hacker News reported in August, the cryptography held. The plumbing failed.
What to Actually Use
For most accounts, TOTP remains the right answer. You choose where the secrets live—Proton Authenticator, Ente Auth, Bitwarden—all of which offer open-source sync with no gatekeeping on which OS you’re allowed to run. TOTP is not phishing-resistant the way passkeys are, and that is a real limitation. But it is also a limitation you own. Hardware security keys give you phishing resistance without surrendering credential custody: the key never leaves the hardware, attestation is transparent, and no sync layer means no sync attack surface.
Passkeys are fine where they’re convenient. Use them if a service offers them alongside alternatives. The line to hold is against services that require passkeys exclusively, particularly with attestation—because that requirement is not about your security. It’s about the platform’s control over your access. As the original “Passkeys are a trap” argument frames it: TOTP gives you the same meaningful security upgrade over passwords, without handing the key to your digital life to a platform gatekeeper.
Key Takeaways
- Passkeys genuinely prevent phishing by binding credentials to exact domains—this benefit is real and worth acknowledging
- Remote attestation is a separate feature that lets websites verify and reject users based on their OS, firmware, and software stack
- The Austrian government already uses attestation to deny access to citizens running open-source or non-whitelisted authenticators
- The 2026 Black Hat research (CVE-2026-34348, Unit 42, Mollema) showed infrastructure—not FIDO2 cryptography—is the actual attack surface
- TOTP gives you control over where your secrets live; hardware security keys give you phishing resistance without cloud sync attack vectors
- Push back against any service that makes passkeys mandatory with attestation—that requirement serves the platform, not you
