Passkeys – Under the Hood
Passkeys, the new WebAuthn-based alternative to passwords, are drawing mixed reactions as they trade some of the strengths of traditional hardware security keys for easier, phone- and browser-integrated logins. Proponents argue that synced, device-based passkeys dramatically improve security and usability for the average user compared to weak, reused passwords and expensive physical tokens. Critics counter that resident credentials introduce storage limits, privacy concerns, weak portability and ecosystem lock-in, reduced flexibility for power users who rely on hardware tokens and strong 2FA, and gaps like limited attestation support that make them unsuitable for some high-assurance or regulated environments.
Non-resident vs. resident keys / passkeys
- Non-resident WebAuthn/U2F keys derive per-site keypairs from a single secret using a server-stored handle; the token stays nearly stateless, can support “unlimited” sites, and leaks no info about where it’s used.
- Resident keys (“discoverable credentials” / passkeys) must store per-site entries on the authenticator to enable username-less login, creating capacity limits (dozens to a few hundred slots) and potential privacy issues (authenticator can be queried for whether an account exists for a domain).
- Several commenters argue passkeys are a downgrade vs. strong unique passwords + hardware 2FA, especially when sites drop non-resident WebAuthn support.
Security vs. usability trade-offs
- For users with weak or reused passwords, passkeys are seen as a major upgrade (phishing resistance, no password leaks).
- For security-conscious users already using hardware keys and password managers, passkeys can reduce flexibility or security (single factor, syncable, limited attestation).
- Some note you can prevent account enumeration with non-resident keys by sending dummy handles, so “need passwords first” is not strictly true.
Hardware tokens vs. synced passkeys
- Hardware keys: strong isolation, attestation, physical presence, PINs, good fit for regulated / high-value environments; but cost, key-loss risk, user key management, and limited resident storage are real problems.
- Passkeys on phones/secure enclaves with cloud sync are seen as the only scalable option for the general population; most users won’t manage separate tokens or backups.
- Concern that FIDO/WebAuthn work is increasingly optimized for platform passkeys, making roaming hardware authenticators second-class.
Ecosystem fragmentation & UX
- Browser and OS support is inconsistent (e.g., Firefox mobile, Chrome flags, UA sniffing); some sites mishandle WebAuthn, restrict roaming keys, or misuse UX flows.
- Password managers increasingly support passkeys (desktop and mobile), but integration and flows (e.g., prompts, autofill, fallback to browser) are still rough.
- Explaining basic “use your face/fingerprint to log in” is easy; explaining recovery, cross-platform moves, and when passwords are still required is seen as hard and under-specified.
Attestation and control
- Hardware tokens provide strong attestation; some regulated sectors depend on it.
- Major platform passkey implementations have disabled or limited attestation for synced credentials, frustrating those use cases.
- Others argue lack of attestation is beneficial for user freedom and against DRM-like control, highlighting a fundamental tension between enterprise control and user autonomy.