Are Passkeys a Trap?
Comments on “Are Passkeys a Trap?”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Jim Taylor rebuts an anonymous essay claiming passkeys let websites use attestation to control which software people run. He argues attestation is optional, most consumer sites don't request it, and major software managers seem to return none. The AAGUID, a model identifier, can be spoofed and reveals little about the OS or browser. Some banks, such as Docomo SMTB Net Bank, do restrict managers. Several of his claims, including FIDO membership figures, are unsourced or unchecked. For builders, AAGUID allow-lists suit policy guidance, not strict enforcement.
Why it ranked
No. 20 of 46 with a score of 0.61. The panel rated it highest on technical depth (0.85) and new information (0.82), lowest on significance (0.47). Placed No. 20, No. 17 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed, technically grounded rebuttal of a viral claim about passkey attestation; substantiated with WebAuthn specifics, though a counter-essay with limited breadth of new findings and an opinionated tone.
- AI judgeJudge 3gpt-5.6-luna
- A technically detailed, evidence-backed security analysis correcting widespread misconceptions about passkeys, attestation, AAGUIDs, and synced credentials. It is highly relevant and actionable, though primarily interpretive rather than a primary research contribution.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.61total under rubric v2.3
- Significance0.47
- Reader interest0.70
- Audience breadth0.66
- Practical relevance0.65
- Substantiated0.70
- Technical depth0.85
- New information0.82
- Counts against: Promotional0.05
- Counts against: Overclaim0.20
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.44 | 0.35 | 0.62 | 0.47 | 0.27 | +0.24 | +0.113 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.53 | 0.70 | 0.88 | 0.70 | 0.35 | +0.26 | +0.183 |
| Audience breadthHow many people who build technology does it concern? | 0.82 | 0.60 | 0.55 | 0.66 | 0.27 | +0.13 | +0.085 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.62 | 0.60 | 0.72 | 0.65 | 0.12 | +0.22 | +0.142 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.47 | 0.80 | 0.82 | 0.70 | 0.35 | +0.05 | +0.035 |
| Technical depthHow technically substantive is it? | 0.89 | 0.80 | 0.86 | 0.85 | 0.09 | +0.05 | +0.042 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.89 | 0.60 | 0.96 | 0.82 | 0.36 | +0.05 | +0.041 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.08 | 0.05 | 0.02 | 0.05 | 0.06 | −0.19 | −0.010 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.27 | 0.15 | 0.18 | 0.20 | 0.12 | −0.11 | −0.022 |
| Sum of contributions | +0.610 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.610 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-09/20/"><img src="https://rubric.hrih.si/badge/2026-11-09/20.svg" alt="Ranked #20 on Rubric, 9 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 3 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceQuote
The WebAuthn spec says the AAGUID is not provably authentic without attestation, and a relying party may use it to infer authenticator properties.
The cited source says the same thing.
The article says “the AAGUID is not provably authentic without attestation”
The source says “The Relying Party MAY use the AAGUID to attempt to identify the maker of the authenticator without requesting and verifying attestation , but the AAGUID is not provably authentic without…”
Source cited by the article: w3.org/TR/webauthn-3
Matches sourceNumber
Open-source passkey managers have been patched to return other AAGUIDs.
The cited source says the same thing.
The article says “Open-source passkey managers can (and have been) patched to return other AAGUIDs”
The source says “Overlay repo for building custom [KeePassXC](https://github.com/keepassxreboot/keepassxc) binaries with dynamically patched WebAuthn/FIDO2 AAGUIDs (default: Managed iCloud Keychain”
Source cited by the article: github.com/mketab/aaguid-bypass-keepassxc
No source givenQuote
Microsoft warns to use AAGUID lists as a policy guide rather than a strict security control when 'Enforce attestation' is set to 'No'.
The article gives no link or citation for it.
The article says “use AAGUID lists as a policy guide rather than a strict security control when ‘Enforce attestation’ is set to ‘No”
The source says No source to compare with.
Couldn’t checkCausal conclusion
A FIDO Alliance member said in a GitHub discussion that KeepassXC risked being blocked by relying parties, in reference to KeepassXC exporting unencrypted passkeys; it was resolved when maintainers agreed to use the FIDO credential exchange protocol.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “This was in reference to KeepassXC exporting unencrypted passkeys, and it was put to bed after KeepassXC maintainers agreed to use the FIDO credential exchange protocol instead”
The source says No passage could be compared.
Source cited by the article: github.com/keepassxreboot/keepassxc/issues/10407
Matches sourceGeneralization
Docomo SMTB Net Bank in Japan limits passkey creation to hardware security keys, Windows Hello, Apple Passwords, Google Password Manager and specific browsers.
The cited source says the same thing.
The article says “Docomo SMTB Net Bank in Japan limits passkey creation to hardware security keys, Windows Hello, Apple Passwords, and Google Password Manager and specific browsers”
The source says “パスキーを安全にご登録・ご利用いただくためには、お使いのデバイス（パソコン、スマートフォン）のOSやブラウザが推奨環境を満たしている必要があります”
Source cited by the article: help.netbk.co.jp/faq_detail.html
Couldn’t checkQuote
A Lloyds Business Banking page says passkeys will be available on Windows devices first, with other devices supported in the future.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Passkeys will be available on Windows devices first. If you’re using a different device, you’ll be able to use passkeys in the future as we expand support”
The source says No passage could be compared.
Source cited by the article: lloydsbank.com/business/help-and-support/online-banking/passkeys.html
No source givenNumber
There are over 250 FIDO members, three standalone password manager companies are on the board, and nine government organizations are members.
The article gives no link or citation for it.
The article says “There are over 250 FIDO members, including many third-party password manager companies. Three standalone password manager companies are on the board”
The source says No source to compare with.
No source givenGeneralization
Most software passkey managers, including Apple Passwords, Google Password Manager and Microsoft Password Manager, don't provide attestation; Google, Apple, Microsoft and standalone managers seem to always respond with none.
The article gives no link or citation for it.
The article says “Most software passkey managers, including Apple Passwords, Google Password Manager, Microsoft Password Manager, and standalone password managers, don’t provide attestation”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 9 Nov 2026, 05:46 UTC. It played no part in the ranking.