Passkeys Attestation Trap

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Passkeys Attestation Trap

Thursday, October 15, 2026 Passkeys Attestation Trap The Hack (Hacker News): Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside. What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.

2026年10月15日，星期四，“密钥认证陷阱”（The Hack/Hacker News）：就像特洛伊木马一样，密钥（passkeys）表面上看起来确实优雅，但内部却隐藏着令人不安的东西。重要的是要了解，与其他任何类型的登录凭据不同，你对自己的密钥并没有最终的控制权。

With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them. […] This is the feature that means you no longer get to make the calls about your passkeys.

对于密码，你可以选择写在哪里；对于身份验证器应用，你可以自行决定使用哪一个（它们基本可以互换）；对于物理安全密钥，如果你确实信任同事，可以将它们交给对方。但密钥附带了一个隐藏的调节旋钮，让使用它们的网站可以逐渐剥夺你随心所欲使用它们的权利。[……] 这个功能意味着你不再能对自己的密钥做主。

Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.

幸运的是，大多数网站目前还不要求使用经过认证的密钥。但 FIDO 联盟的标准无论你是否愿意，都已将认证（attestation）作为密钥生态系统的一部分。即使网站现在不需要认证，只要你使用密钥，就等于向网站表明你的设置支持 FIDO 联盟的密钥标准，并且你作为用户有能力使用密钥。

This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys. […] My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

这意味着一旦 Twitter（现更名为 X）确信绝大多数用户不会受到影响，他们就可以切换开关——也许不是一次性全部切换，而是每次针对一万名用户，以免引起骚乱——并开始拒绝未经认证的密钥。[……] 我的预期是，行业起初会对密钥施加很少的限制，然后逐渐增加，不是在所有网站同时进行，而是错峰进行。几年后，人们就会忘记他们曾经可以选择在密钥上启用哪些安全措施（如果他们甚至知道密钥还有不同种类的话）。

[…] Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing: Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

[……] 远程认证可以让他们验证你的设备是否具备某些能力，例如发送和接收加密消息、运行竞争对手的应用，或在未验证身份的情况下使用社交媒体。苹果目前的密钥实现不支持认证，但听起来这只是在他们解决如何进行同步之前的情况：认证旨在证明特定设备，且仅在创建时证明其具有一组特定的安全属性。对于同步凭据而言，这在很多方面都说不通，包括同步到具有不同安全属性的设备、密钥创建后安全属性的变化、同步架构的安全属性、共享密钥或导出到其他密钥提供商。我们正在与 W3C 和 FIDO 努力解决这些问题。

Ricky Mondello: The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Ricky Mondello：这篇文章基于一种观点，即 WebAuthn 中一种名为“认证”的功能（仅用于高安全性且通常是企业级的场景，且通常配合物理硬件安全密钥使用）会被利用来伤害用户。文章假设像 X 这样的网站会诱导并欺骗用户：先让你获得一个密钥，然后稍后换成可怕的“已认证”密钥！这根本不可能实现，因为认证在面向大众市场的消费者 Web 身份验证中并不受支持。

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

针对密钥（基于软件、可同步的凭据）的认证与它们的大众市场目标背道而驰，并将排挤掉独立的、非企业支持的凭据管理器。这是密钥设计者明确不追求的目标，他们在一个任何人都可以加入的论坛中共同工作。相信我，像银行这样的网站和应用在密钥行业发展的初期曾多次要求认证。平台、浏览器和凭据管理应用一直坚持认为，密钥的目标是减少网络钓鱼，而不是某种可信计算方案。（我还要补充一句：除非我死了！）

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

我相信这并非 Mondello 和其他参与此项工作的人的目标，但到目前为止，我还不相信他们能够控制住局面。听起来苹果正在研究它，一旦技术发布，有什么能阻止大型网站强迫用户使用它呢？看起来这只需要几个大型凭据管理器的合作即可。从让他们的产品成为必需品这一角度来看，这对他们是有利的。而抵制这一做法的小型凭据管理器将被排挤出局。

varx: The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.) And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear — it’s a real restriction on user freedoms that’s already happening right now.

varx：网站和应用一直在要求认证这一事实，恰恰加强了那篇关于密钥文章的核心观点！诚然，浏览器目前还不支持它，但这正是可能改变的事情，也是过去发生过改变的事情。看看关于 Widevine 和 Firefox 的脚注。（“目前不支持”也非常容易改变。）而且我们已经有网站和应用在对密钥供应商进行白名单限制。这绝非理论上的“滑坡谬误”担忧——这是已经在发生的对用户自由的真实限制。

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

我不认为文章中的几个错误点（例如 TOTP 的问题）会使文章的核心观点失效，因为这篇文章并非基于权威论证。作者提出了一些能够自圆其说的有力观点。

Ricky Mondello: To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

Ricky Mondello：需要明确的是，网站已经停止要求认证了。或者至少，他们不再问我了。为什么？因为他们知道问了也没用——操作系统供应商、浏览器和密钥管理器在这一阵线上是统一的。现在他们已经亲眼看到，没有认证的密钥非常棒，是一个巨大的进步。

iinuwa: This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it come

iinuwa：这与用户利益背道而驰，因为能够实现这一点的身份验证器类型（安全密钥）很难使用。拥有可以为用户进行账户恢复的 IT 部门的公司可以处理这个问题，但普通用户做不到。同步密钥是解决消费者这一问题的答案，因此认证不属于消费者领域。这就是为什么密码管理器在规范小组中每次遇到这种情况时都会进行抵制的原因。