Michael Tsai warns that passkey attestation gradually strips users of control over their credentials, as websites can later require attested passkeys and reject non-attested ones. While not yet widely enforced, the FIDO Alliance standard embeds this capability, and sites like X could switch to mandatory attestation incrementally.
Background
Passkeys are a passwordless authentication standard based on FIDO2/WebAuthn, allowing users to authenticate using biometrics or device PINs instead of traditional passwords. Attestation refers to the ability of a relying party to verify the authenticator's origin and capabilities.
- Source
- Lobsters
- Published
- Oct 22, 2026 at 02:16 AM
- Score
- 6.0 / 10