Passkey attestation identifies an authenticator, not your whole computer

Security researcher Scott Helme separates passkey attestation from claims that websites can inspect an entire operating system through it. Attestation identifies an authenticator’s make and model; commonly used synced passkeys generally provide none. He also explains why a passkey tied to a website’s domain resists lookalike-site phishing, while a password and a one-time code can still be relayed through a fraudulent login page.

Scott Helme · Oct 14, 2026

Why it matters

Authentication decisions improve when phishing resistance and device restrictions are treated as separate technical questions.

More context

Helme responds to an argument against passkeys using implementation experience and linked references. For an existing sign-in system, inspect which authenticator and recovery paths it supports rather than assuming all passkeys behave alike. Hardware security keys can provide attestation, including enterprise-specific uses.

Keep in mind

This is an expert explanation, not an audit of every provider. Domain binding does not make an already compromised application or stolen authenticated session safe.

Original read