this post was submitted on 12 Oct 2026
267 points (84.7% liked)
Privacy
51408 readers
679 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is some weird doom and gloom take on a real improvement in public security that we don't see very often. Of course there are a lot of stake holders. Of course every protocol is complicated. I run security for a company, and my auth systems mandate attested (i.e., company-provided) hardware keys. You're not using a passkey on my systems that I'm not providing you. Pretty simple concept, yes?
Do you have any examples of any public service requiring attested keys? No, because it really doesn't make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.
I agree it would be helpful to make the feature set clearer to the end user, but the UX are still a mess across OS and websites. IMO that's not a reason to not use them.
Passkeys are much more phishing resistant. They apply unqiue-credential best practices. I've been managing unique passwords for decades, and passkeys are a great improvement. Very few companies are going to completely remove other forms of auth, and so suggesting passkeys are ruining people's ability to share passwords is really premature. And even so, companies have been pursuing other strategies for identifying shared accounts much more effectively than shared credentials. Thinking that's a reason to not use passkeys just tells me you aren't valuing how passkeys elevate public opsec.
Passkeys are projected to overcome TOTP market share next year. That is honestly amazing. I like the writeup on the features, but this nefarious, conspiratorial narrative doesn't fit what's actually happening.
There are lots of reasons to like passkeys from a technical/enterprise standpoint, but I do think you're missing the critical issue the article is speaking to: digital sovereignty.
Passkeys, while more secure in the average usecase, shift the balance of control over your access to services. Yes, you can no longer write your password down on a post-it and leak it in a photo—thats's a good property. But trading that at the expense of your freedom to run software as you see fit on hardware you bought and paid for? For many people, myself included, that's not an acceptable tradeoff. There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.
The thing that should chill everyone is the fact that built into the standard is a switch (given to service providers, not users) that locks out the people that do want to have control of their digital infrastructure. Not everyone can or should be expected to run like that, but they should not be blocked from doing so. Similar with the Right to Repair; not everyone can exercise that right on their own, but no one should be prevented from repairing what they bought.
Similary, I do believe it's my neighbor's right to practice a religion of their choosing. So if the government tries to prevent them from doing that, I'm going to go grab my pitchfork, not because I share their religion, but because they should be able to make that choice. Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else's ability to do it.
And to address the slippery slope objection, I have to point out that this is not particularly theoretical. When Big Tech has provided service providers with the opportunity to enforce restrictions on your device, service providers have used it. Widevine DRM, Google Play Protect, etc.. It's why my LineageOS phone can't use banking apps, which is a shame since some features like Zelle payments are specifically a mobile-only feature, and so I cannot use it anymore. I either run my phone to the exact specs and settings that my bank and Google prefer, or I'm denied access to basic banking anywhere but my desktop (and who knows how long until the block my access there, I run Linux afterall).
I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn't buy into their ecosystem, and further entrenches those who already are. I for one find that despicable, and an unacceptable tradeoff. There's no reason it has to be this way though, passkeys could have been the best of both worlds. However, they've been compromised with features that serve platforms at the expense of user freedom. It's the kind of disempowerment that happens when you give the reins to power-hungry, profit-seeking corporations.
I can only speak for myself, but I hold all of those values you claim. I see no evidence, technical or otherwise, that passkeys are subverting or acting counter to any of these principles. Frankly, it's a baseless claim that passkeys lock people out of their own control/infrastructure. I think people conflate non-transferable, TPM passkeys with passkeys. Just don't use that if you don't want to.
FWIW, passwords were never "yours", they are PSK (Pre-Shared Key) with a service. Maybe you invented the credential, but it's not yours. You have historically enjoyed being able to bulk export credentials, and if that property is important to you, then you should be using transferable passkeys. Passkeys have a well-defined transferable format -- if they are the type that can be exported.
I can only continue repeating that the passkey spec is public and transparent. If the service is not supporting passkeys in a way that you want to use them, then complain to that service. I don't decide that service X doesn't support transferable passkeys, but they should.
DRM and other gate keeping efforts, IMO, are tangential to passkey support. Passkeys are fine, vendor-locking and walled gardens are not.
This is the equivalent of Sony arguing that you never owned any games, you owned a license. Congrats. You’re the best kind of correct - technically correct.
There is no flag on a password that determines if it is transferable. There is no amount of “if you don’t like it, don’t use it” that will work out in your favor if you’re not in the majority. If you give corporations the power to limit consumption while increasing prices, they will eventually use it. Especially if they provide a product you can’t get anywhere else (and this is their goal for every product - even if they have to buy other companies to do it - even if they have to collude to offer the same service). It’s the foundation of our entire economic system.
It's far from that and bad analogies pollute otherwise very simple conversations. If you want a more apt analogy, this "debate" is shaping up closer to LED vs incandescent bulbs.
It's easy to say passwords are sufficient when you're one person practicing good op-sec. It's not when you're supporting thousands of people of varying technical proficiency, thousands of machines, thousands of services, and thousands of bad-actors. It was an even simpler time when 4 digit PINs were "sufficient", but the world you and I live in is more complicated. Certain passkeys are transferable, so you're not even losing out on that capability. Curmudgeon arguments aren't convincing. Passkeys aren't "giving power away". Using passkeys doesn't mean your giving up freedom. Passkeys have no bearing on the "economic system" and inflation. As far as the IT ecosystem is concerned, we've never lived in a more open and capable time. There are so many alternatives to every service (that isn't tightly coupled to copyright). Of course companies are trying to offer unique products people can't get anywhere else. None of this has to do with passkeys.
Here’s what I don’t get. When I posted this, you were posting every 10 minutes at most defending passkeys. How do you have so much energy and time to defend them so vehemently? Are you heavily invested in a passkey business? Are you an LLM that’s been instructed to defend LLMs at all costs?
I’m not sure the latter is possible since you wrote a large paragraph starting with “it’s easy to say passwords are sufficient” when that has absolutely nothing to do with my opinion on passwords. I suspect an LLM would’ve stuck a little closer to my own words.
No, I'm just a professional software engineer that has been in security and privacy for the last ~9 years (unrelated to passkeys). But I am also head of security for my company and rolled out updated hardware keys in the last year, so am somewhat more familiar with the topic as of recent.
I also generally enjoy discussing privacy topics. Even more so when I feel the community's understanding is off /shrug. Was chilling on my phone while the kids were crashed this afternoon.