Meanwhile, half of the people at every company I’ve ever worked at:
Oct0ber2026!
That’s why you should never change your password. No one will think to guess @utumn2O23 in 2026.
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You don’t remember them you are not expected to moving from iOS to Android lets say generate new ones for your new device.
Or “Like all questions of security vs convenience, a user should decide what they are or are not comfortable with.”
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it’s not a problem, but how can we know it won’t be in future?
Admittedly I didn’t read that one guy’s blog post very closely, but it seemed to claim that because some companies may some day misuse/abuse some features of passkeys, passkeys are poison and no one should ever use them.
Well if that’s possible, it doesn’t sound like a good basis for security.
It’s a very basic principle, that you don’t create powers that could be abused. That they haven’t been abused yet does not make doing so ok. It like saying it’s ok that my government was given the power to lock people up with no reason or due process because they haven’t used it yet.
so whats a passkey and how is it different from a password?
It’s essentially just public key cryptography streamlined to reduce friction for the user. When you’re prompted to create a passkey for a service a new public/private keypair is created. The private key can then be synced to other devices for example via the iCloud keychain or Bitwarden. Obviously you have to then trust that provider to keep your keys safe. The upside is that your passkey can be automatically discovered and used to sign in without using a password. Alternatively the private key can be device bound but the downside is that if you lose the device you lose the private key too.
If it was just to helpfully reduce friction, it wouldn’t be so controversial. The inclusion of any sort of TPM and hardware attestation support at all is what has some people sounding the alarm (in my opinion rightfully).
It’s mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.
But the websites supporting it put out big warnings when you don’t have another method to login configured. And they don’t actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.
Quite the contrary: “there is a problem with your passkey/account, please use the recovery method you set up” even makes for more convincing phishing. So why are they pushing for passkeys when it isn’t for security reasons?
This is, imo, the bigger issue. No clean way to export and move passkeys around, even between the open source options like Bitwarden and Proton Pass or as plain backups…
