this post was submitted on 14 Oct 2026
29 points (76.4% liked)

Pulse of Truth

2573 readers
149 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

founded 3 years ago
MODERATORS
krogoth@infosec.pub
29
Passkeys are a trap. Do not use them. (nonfunctional.substack.com)
submitted 6 days ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub
8 comments fedilink hide all child comments
 

Seems like every website wants us to stop using passwords. There is a replacement we are being asked to use instead called passkeys. This should be a tad concerning if passwords are familiar to you and you don’t fully understand these nebulous passkeys.

Websites say that passkeys are more secure or more convenient or something similarly beneficial. While it is true that passkeys can be far more secure than passwords, and may indeed be more convenient, that’s not the whole story. Passkeys are not designed to prioritize your interests. Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

you are viewing a single comment's thread
view the rest of the comments
[–] lemmysmash@beehaw.org 1 points 6 days ago

Basically, there's nothing wrong with passkeys as technology, except the last piece that author states: remote attestation.

Remote attestatio is utter anti-consumer garbage. And essentially it's the goal of bigtech & govs to force everyone under that utter garbage.

So the problem with passkeys is that 99% of users ("the normies") will use whatever wallet their device is providing. Which is exactly bigtech-controlled wallet.

And this combination of:

  • remote attestation
  • 99% of users
  • bigtech-controlled wallets

is exactly that would allow the said bigtech, their compliances, and govs to forbid any other wallets, and vendorlock you to the whole hardware-software stack... tada!... also controlled by bigtech.