I was getting on board with passkeys. Now this.

Summary

The video examines whether passkeys are a security improvement or could eventually be used to restrict which devices and software people can use to log in. It responds to the Hacker News article “Passkeys are a trap. Do not use them.”

How passkeys work

A passkey uses a public/private key pair. The website stores the public key, while the private key stays on the user’s device. Because the private key is not sent to the site and passkeys are tied to a website’s domain, they are more resistant to phishing and password-database leaks than passwords.

What attestation does

Attestation adds verifiable information about how and where a passkey was created, such as the passkey manager, device, operating system, or firmware. A site can use that information to reject logins from software or devices it does not approve.

The speaker says attestation is not what protects the private key or makes ordinary passkey logins secure. Non-attested passkeys still provide key-pair and domain-binding protections; attestation mainly gives the relying site more assurance about the user’s setup.

Potential uses and concerns

Attestation may be useful for organizations handling sensitive data, such as banks or law firms, that want staff to use managed, untampered devices. In those settings, an organization can enforce its own security requirements.

The article raises the concern that if ordinary services began requiring attestation, they could block users of unapproved operating systems, browsers, or passkey managers. It imagines this being used to encourage platform lock-in—for example, restricting access after someone switches operating systems or browsers.

The speaker considers this a possible future risk, but not an immediate problem. They view attestation primarily as a feature for heightened-security environments and suggest that broader restrictions could emerge as an unintended consequence rather than as the feature’s original purpose. They also note that the FIDO Alliance is made up largely of major companies and institutions, raising questions about how well user interests are represented.

Alternatives and adoption

Time-based one-time passwords (TOTP) are presented as a secure alternative, though one that can be inconvenient for many users. Passkeys may offer an easier route to broader adoption and fewer password-related risks, although they can be confusing and technically complex.

Platform caveat

Based on the speaker’s reading of the documentation, Apple appears to support requiring attestation for managed-device scenarios, but not for ordinary third-party websites. The speaker acknowledges that the documentation is unclear and that platform policies could change.

Review and sources

This is a high-level explainer of passkeys and attestation, alongside an analysis of the article’s claims. It is not a step-by-step setup tutorial.

Kevin Powell is the main speaker. The video discusses “Passkeys are a trap. Do not use them” and references the FIDO Alliance and its role in passkey standards.