Passkeys are a trap
Passkeys—login credentials based on public‑key cryptography and often synced by Apple, Google, or password managers—are praised for being far more phishing‑resistant than passwords and TOTP codes, and for dramatically improving everyday login UX. Critics, however, argue that the underlying WebAuthn/FIDO standards enable “attested” passkeys tied to specific hardware and OS stacks, which sites could eventually require, locking users into major platforms and excluding FOSS or non‑approved devices. Many see today’s convenient, copyable passkeys as a potential Trojan horse: safe and useful now, but with a real risk of future vendor control and reduced user freedom if attestation becomes widely enforced.
Perceived benefits of passkeys
- Strong support for passkeys as phishing‑resistant: keys are domain‑bound, never transmitted, and stolen server databases only leak public keys.
- Many see them as dramatically better UX than passwords+TOTP/SMS: “one click and in”, no code typing, no password complexity rules, no password reuse.
- Advocates note they’re essentially “SSH‑style” public key auth wrapped in browser/OS UX, solving problems that users won’t ever manage manually.
- Hardware tokens (FIDO/U2F keys, Yubikeys) and password‑manager‑backed passkeys are praised as giving strong security plus some user control.
Main concerns: attestation, control, and “trap” framing
- Central worry: WebAuthn/Passkey specs support remote attestation, allowing sites to require hardware‑backed, non‑exportable, platform‑approved credentials.
- Fear that once passkeys are widely adopted, major sites (especially banks, streaming, social) will “flip the switch” and:
- Reject non‑attested or software‑managed passkeys (Bitwarden, KeePassXC, etc.).
- Lock out FOSS devices, custom ROMs, rooted/bootloader‑unlocked phones, and non‑standard OSes.
- Several see this as part of the broader “trusted computing / secure boot / DRM / device attestation” trend that reduces user control.
- Others argue this is overblown: attestation is legacy enterprise tech, awkward to operate at consumer scale, and currently not used or even supported by some major platforms.
Security comparisons: TOTP, SMS, passwords, hardware keys
- TOTP:
- Pro: user‑controlled, portable, works with any client, easy to back up.
- Con: fundamentally phishable; shared secrets on servers can be exfiltrated; still relies on passwords.
- SMS and email OTP are widely called weak: SIM‑swap, interception, social engineering, and false sense of security.
- Some argue “TOTP is good enough” and passkeys mainly add complexity and policy risk; others call that “this decade’s ‘just use better passwords’”.
Usability, portability, and lock‑in worries
- Many complaints about fragmented UX: each site’s flow (username first vs passkey first, extra email codes, etc.) differs and can be confusing.
- People dislike being forced into platform passkey stores (Apple/Google/Windows) and not being able to choose where a passkey lives or export it easily.
- Concerns about losing access if a phone is lost or an account with a big vendor is locked or banned.
- Power users want:
- Multiple independent authenticators per account.
- Offline backups (including “metal safe” copies).
- Continued support for passwords/TOTP or FIDO keys as alternatives.
Enterprise vs consumer and policy angle
- Many agree attestation and strict hardware policies are appropriate for some enterprise or critical‑infrastructure cases.
- Debate centers on whether those mechanisms will leak into general consumer web auth.
- Some see this as primarily a policy problem (regulation, banking rules, corporate incentives), not a flaw unique to passkeys.
- Others argue standards that make lock‑in and attestation easy are themselves dangerous, regardless of current usage.