Passkeys are not a trap. Use them!

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme.

Isn’t this exactly what Microsoft Authenticator app does now? MS requires its own app to log in to corporate outlook accounts, and does not support TOTP and other password managers any more. So, authentication is more and more linked with identification of the user, and attestation. For example, the backup method is a phone call, which requires the user to reveal their phone number to Microsoft. And a future version of the MS authenticator app could easily require to add fingerprints, or facial recognition.

This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers.

The argument is there that requiring attestation would harm mass market adoption. This might be true for some optional services. But it is not true for those services that a lot of people simple have come to rely on to organize their daily life - Google Mail, MS Outlook for work mail, things like DHL parcel delivery, public transport, and so on. These services are in 2026 not optional any more, and the corporations providing them are pushing hard to identify and attest users.

Another case where this has been happening if for example the German national train network, which requires for full usability and getting discounts to use its app, and which requires a user identification for any payments. The net effect is that you can hardly use the train without being fully traceable. This isn’t very nice if you are a normal citizen in a democracy, but becomes quickly dangerous if you are member of a minority group in a country governed by the nationalist far right or an authoritarian government.

Passkey is barely implemented, seriously we have GPG keys or ssh keys and big tech refuses to implement at least that. Instead they are pushing for their Product™ to sell.

Hardware solution could be nice but the market is stacked against any nice solution: I way a key I can backup, even emulate if I want too (having a purely digital copy). I don’t see the issue with ssh key in general.

One technical alternative for Linux users is to use for example the pass program, which stores via GnuPG keys, and put the key on a GnuPG SmartCard. This enables a kind of 2FA on the user side (one needs the SmartCard and its PIN).

Another alternative would be KeePassX and YubiKey.

Another password and TOTP, which can be required on the service side.

This does not fully protect against phishing but is very helpful for using unique strong passwords.

I do not think the phishing protection is worth additional privacy erosion. Privacy is not really a nice-to-have. Due to targeted advertising (see the Cambridge Analytica example), loss of privacy is turning into a real threat for our democracy.

Honestly the original post arguing against them makes very valid points that I wasn’t expecting to read to the end, even if they probably lost 90%+ of readers with the length that could have been cut down.

Speaking as a GrapheneOS and Linux user, the possibility of remote attestation to stop me from doing so is a legitimately shitty thought.

Been quite a fan of the convenience though as I just hate having to keep my phone on me all the time. So I’m torn, but will continue using them at least until a whiff of big tech buffoonery comes around.

Edit: Ricky’s arguments seem sound but I think you can also tack on “for now” to all of them. They also work for Apple so worth mentioning that potential conflict of interest/bias. I’d be curious of GrapheneOS’s take.

Not a single explanation of passkeys has managed to to convince me they are more secure than a password and MFA. All you need is access to someones phone. Before you needed a complex password and access to my phone.

The passkey also can’t be backed up or replaced like MFA tied to my phone if it should unexpectedly die.

Congrats we’ve reduced account access to a single point of failure?

I swear most people have forgotten what TOTP was used for in the first place - two-factor auth to protect people re-using passwords getting hit by password breaches on other services, people using low complexity passwords, and to protect people’s breeched devices (e.g. computers getting viruses or malware or drive-by credential nabbers that give the attacker access to your credentials in some way). In short, to solve some poor security practices. 2FA via TOPT still solves all of those problems.

Passkeys fix a different problem. On their own as a technology they essentially just increase the quality of a password, while tying that password to a single device. So they fix the problems of re-used passwords, and unsophisticated passwords. But with many implementations they fall back to being single-factor auth - if a user has access to your device, they can use the passkey (with exceptions such as passkeys stored on a physical second-factor like a Yubikey that requires physical approval to use).

TOTP meanwhile requires two devices to be accessed by design.

As myself and most tech-aware users already use unique, sophisticated passwords - they don’t solve a problem for us.

However, if businesses allow passkeys as a simple password alternative, while still allowing TOTP as a second factor, I’d be happy to do so for critical access items (mostly banking). However, I’m not aware of this being the case for any common implementations in major businesses.

Passkeys are just ‘Yubikey without the Yubikey or physical approval’ - pointless to me. False sense of security even.

How do you phish someone’s TOTP?

No