Passkeys are a trap (nonfunctional.substack.com)

Article summary

The article discusses the potential drawbacks of passkeys, a new type of login credential being promoted by the FIDO Alliance. Unlike passwords, passkeys can be designed to limit user control, with features such as non-copyability and hardware-backing. The author argues that this could lead to a loss of autonomy for users, as websites may begin to require specific types of passkeys that users cannot control. The article also highlights the complexity of the passkey standard, which can be confusing for users.

Main themes

• passkey security
• user control and autonomy
• password management
• online security
• hardware support
• proprietary ecosystems
• remote attestation
• flexibility and interoperability

What commenters say

• Passkeys can be a convenient and secure alternative to passwords, but may also limit user control and autonomy.
• The use of passkeys may lead to a loss of flexibility and interoperability, as different devices and platforms may not support the same types of passkeys.
• Some commenters argue that password managers can provide a similar level of security and convenience to passkeys, while also giving users more control over their credentials.
• Others believe that passkeys are a necessary step towards improving online security, and that the benefits outweigh the potential drawbacks.
• There is disagreement over the level of hardware support for passkeys, with some arguing that it is good and others claiming that it is limited.
• Some commenters are concerned that passkeys could be used to lock users into proprietary ecosystems, limiting their ability to choose their own devices and platforms.
• The use of remote attestation and hardware-backing in passkeys is seen as a potential threat to user control and autonomy by some commenters.
• Others argue that these features are necessary for improving security, and that users can still maintain control over their passkeys by using flexible password managers.