Passkeys Are Not a Trap

Automated excerpt

It just doesn't match how any of this actually works... Your Passkeys Don't AttestThe passkeys most people use are synced passkeys, stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or whatever other software of your choosing. These passkeys don't give websites an attestation statement at all, and though a site can ask, what comes back is none. I built and deployed passkeys support on my own SaaS company. We built our own passkeys library and had it security reviewed. I wrote about Security considerations when using Passkeys on your website.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.