---
title: "XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None"
url: https://daily.dev/posts/xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none-u4oeenxph
source_url: https://scotthelme.ghost.io/xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none
type: article
source: "Scott Helme"
published: 2026-05-19T12:30:55.449Z
updated: 2026-05-19T12:31:19.174Z
tags: ["security", "passkeys"]
reading_time: 18
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None

**[Scott Helme](https://daily.dev/sources/scotthelme)** · 18 min read · 0 upvotes · 0 comments

## Summary

A single XSS vulnerability can silently register an attacker-controlled passkey on a victim's account, creating a persistent authentication backdoor. This is possible because most services use `attestation: "none"` to support synced passkeys from password managers like 1Password and iCloud Keychain — which cannot provide hardware attestation. Without attestation, the entire passkey registration flow can be replicated in JavaScript, requiring no user interaction. Attackers can also proxy WebAuthn API calls to substitute the victim's passkey with their own, leaving the victim with a non-functional passkey while the attacker retains access. Defenses include requiring step-up authentication before passkey registration, deploying a strong Content Security Policy, using Permissions Policy to restrict WebAuthn API access, and sending out-of-band notifications when new passkeys are registered.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://scotthelme.ghost.io/xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none>

## Similar posts on daily.dev

- [Recap of Our “Passkeys Pwned” Talk at DEF CON](https://daily.dev/posts/recap-of-our-passkeys-pwned-talk-at-def-con-82de3ycy9) · Security Boulevard · 0 upvotes · 0 comments
- [Security considerations when using Passkeys on your website](https://daily.dev/posts/security-considerations-when-using-passkeys-on-your-website-kzkloroe8) · Scott Helme · 0 upvotes · 0 comments
- [How Attackers Bypass Synced Passkeys](https://daily.dev/posts/how-attackers-bypass-synced-passkeys-fc1em5n6y) · The Hacker News · 0 upvotes · 0 comments
- [Bringing in the experts; Having our Passkeys implementation Security Tested](https://daily.dev/posts/bringing-in-the-experts-having-our-passkeys-implementation-security-tested-kevskr6zx) · Scott Helme · 0 upvotes · 0 comments
- [Passkeys Aren’t Nearly as Effective as We Thought](https://daily.dev/posts/passkeys-aren-t-nearly-as-effective-as-we-thought-b6ht2lwhf) · InfoSec Write-ups · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#passkeys](https://daily.dev/tags/passkeys)

[View this post on daily.dev](https://daily.dev/posts/xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none-u4oeenxph)