DE — heise online

Why Passkeys Are Not a Trap: Passkey Attestation Explained

SecurityOctober 20, 20261 min read

This is a short preview of a heise+ article. It explains why passkeys are safe to use, after a viral blog post called them a trap.

A viral warning about passkeys

A blog post titled "Passkeys are a trap. Do not use them." trended on the tech forum Hacker News in mid-October. Security experts say almost everything in the post is wrong. The article explains the topic of passkey attestation in simple terms.

Key facts from the survey

The FIDO Alliance surveyed 11,000 internet users in 10 countries.
90 percent of those surveyed know passkeys.
75 percent have turned on passkeys for at least some accounts.
49 percent say they use passkeys regularly.

What passkeys are

Passkeys are a way to log in without a password. Apple introduced the name and the method at its developer conference WWDC 2022. The FIDO Alliance, which includes big tech firms and password manager makers, wants to replace passwords completely.

Why it matters

Passkeys are easy to use. If a website sets them up correctly, they are also safer than passwords. Knowing the facts helps people decide whether to trust this login method.

What to watch

Whether more websites support passkeys correctly.
How the debate about passkey attestation develops.
Whether more people switch from passwords to passkeys.

Glossary

Passkey: A password-free login method that uses a digital key stored on your device.
Hacker News: A tech discussion forum where users share and comment on news and posts.
WWDC: Apple's yearly developer conference, where new software is shown.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.