Totp

Security researcher pushes back on viral claim that passkeys enable device lockdown

A widely shared post titled 'Passkeys are a trap' argued that passkey attestation could let websites eventually restrict logins to approved apps, operating systems and devices. A developer who built an open-source passkeys library has published a rebuttal, saying most consumer passkeys—synced ones stored in iCloud Keychain, Google Password Manager or apps like 1Password and Bitwarden—do not send attestation data at all, even when a site requests it.