Passkeys give me anxiety because it's like "Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO"

Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.

When something wants too much power, you must avoid.

If your security relies on a password, you will always be anxious that somebody, somewhere, has somehow figured out what it is and already has access to your bank account.

No I won't. All my passwords are something like I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvb and each is used for only one thing because I've been using a password manager for over a decade.

An attempt to make an image describing where passkeys live:

So it’s HDMI for login? Thanks, I hate it.

As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?

Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn't Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).

But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator...

We've been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for "security"?

It seems perfectly in line, and I think this article draws all the right parallels.

This is some weird doom and gloom take on a real improvement in public security that we don't see very often. Of course there are a lot of stake holders. Of course every protocol is complicated. I run security for a company, and my auth systems mandate attested (i.e., company-provided) hardware keys. You're not using a passkey on my systems that I'm not providing you. Pretty simple concept, yes?

Do you have any examples of any public service requiring attested keys? No, because it really doesn't make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.

I agree it would be helpful to make the feature set clearer to the end user, but the UX are still a mess across OS and websites. IMO that's not a reason to not use them.

Passkeys are much more phishing resistant. They apply unqiue-credential best practices. I've been managing unique passwords for decades, and passkeys are a great improvement. Very few companies are going to completely remove other forms of auth, and so suggesting passkeys are ruining people's ability to share passwords is really premature. And even so, companies have been pursuing other strategies for identifying shared accounts much more effectively than shared credentials. Thinking that's a reason to not use passkeys just tells me you aren't valuing how passkeys elevate public opsec.

Passkeys are projected to overcome TOTP market share next year. That is honestly amazing. I like the writeup on the features, but this nefarious, conspiratorial narrative doesn't fit what's actually happening.

Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they

• force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
• add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That's not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
• take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
• deny me anonymity and control over my accounts. I can have only one account per domain.
• are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.

The recommendation “do not use them” is cute. They are forced on people. I can't choose.

Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.

Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:

Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.

I don't see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.

Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn't make them "traps".

This is why I only use passkeys that are stored in my self hosted vault warden. As long as you don't create passkeys locked to a vendor's manager, I don't see any reason to avoid them.

Never used. Each time a website asks me if I want to create one I have this uneasy feeling of not actually owning the key.

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)

The convenience of using passkeys is a double-edged sword.

This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.

dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?

Healthequity tried forcing this passkey garbage on me, and they wouldn't allow me to manage investments over the phone, so I ended up transferring everything to a different HSA provider. Not giving in. I love TOTP though.

you do not have ultimate control over your passkeys.

Looks like it boils down to that? Because I just started using a few and they're on my self hosted vaultwarden so...

Basically the problem is that Passkeys are designed to allow a particularly bad enshittification once everyone uses them. So it's not about downsides of using them now, but about them being used in general and then abused.

I like the article and agree with the problem, but I'm skeptical that this works as a strategy to fix the problem. First off, individual responsibility or boycott doesn't really work. Most people will just use what their phone gives. Second if the corporations do want to do this, they could implement it separately in their apps, like twitter or google chrome requiring quasi-attested "homebrew" passkeys stored in cryptoprocessors. Ultimately I do not think we have any power to prevent them from doing that.

The time of democracy and pluralism is over. We're already seeing the author of the article being maligned and personally attacked for talking about AI - how dares he? On all fronts we have lost the culture war and lost power, economic power, information power like access to truth.

finally people are waking up to this garbage.

Ah there's that phrase again, remote attestation. That has very quickly become my least favourite phrase, and I've yet to see an example of it that benefits the end user. I didn't know passkeys supported it but I'll be avoiding them even harder now that I know they do.

I've already been avoiding them because I don't see how there's any security advantage over TOTP unless the passkey is the only way to access the account (which would be awful for account recovery). And the concept of tying my login to a specific device is stupid. I also don't appreciate how many websites keep trying to stealthily create passkeys automatically on login without explaining what they are or letting the user make an informed decision.

So... Uh... What's a passkey? The article is saying they're pure evil. Everyone here is saying they're good. Everyone knows what they are except for me.

What's the difference between a passkey and a password?