This is some weird doom and gloom take on a real improvement in public security that we don't see very often. Of course there are a lot of stake holders. Of course every protocol is complicated. I run security for a company, and my auth systems mandate attested (i.e., company-provided) hardware keys. You're not using a passkey on my systems that I'm not providing you. Pretty simple concept, yes?

Do you have any examples of any public service requiring attested keys? No, because it really doesn't make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.

I agree it would be helpful to make the feature set clearer to the end user, but the UX are still a mess across OS and websites. IMO that's not a reason to not use them.

Passkeys are much more phishing resistant. They apply unqiue-credential best practices. I've been managing unique passwords for decades, and passkeys are a great improvement. Very few companies are going to completely remove other forms of auth, and so suggesting passkeys are ruining people's ability to share passwords is really premature. And even so, companies have been pursuing other strategies for identifying shared accounts much more effectively than shared credentials. Thinking that's a reason to not use passkeys just tells me you aren't valuing how passkeys elevate public opsec.

Passkeys are projected to overcome TOTP market share next year. That is honestly amazing. I like the writeup on the features, but this nefarious, conspiratorial narrative doesn't fit what's actually happening.