Passkeys Are Not a Trap: Debunking the Viral Claim
A viral post claims passkeys are a trap due to hidden attestation. Scott Helme, who built a passkeys library, explains that synced passkeys don't attest, attestation only reveals authenticator model, and the post's YubiKey recommendation ironically pushes attestation. He argues passkeys are phishing-resistant and swapping them for TOTP is a bad trade.
The author even concedes this in the addendum, saying that passkeys are domain-bound and resist man-in-the-middle attacks, but still tells readers to avoid them. Swapping a phishing-resistant credential for a phishable one is a really bad trade...