Passkeys are a trap

If you use passkeys, you may find your control over account access is reduced without your explicit awareness.

A recent article argues against the widespread adoption of passkeys, a technology intended to replace traditional passwords. The author asserts that passkeys, despite their advertised security and convenience benefits, are designed without prioritizing user interests. Unlike passwords or authenticator app codes, users do not retain ultimate control over passkeys. The FIDO Alliance, a consortium of tech companies, governments, and financial institutions, is promoting passkeys, but the author notes the absence of consumer advocacy groups in its membership. The article contrasts passkeys with Time-Based One-Time Passwords (TOTP) generated by authenticator apps, which rely on an open standard and offer users more control over storage and sharing. The author contends that the term "passkey" encompasses various implementations, some of which are deliberately designed to restrict user control and shareability, creating potential confusion and hidden drawbacks.

The core issue with passkeys, as presented, is the intentional ambiguity and lack of user control inherent in their design, orchestrated by the FIDO Alliance. While passkeys can be technically secure, their architecture allows service providers to gradually revoke user agency, a departure from the user-centric flexibility offered by older methods like TOTP. This means users may not truly own or control their authentication credentials, potentially leading to vendor lock-in or unforeseen access limitations.

The FIDO Alliance's composition, lacking consumer advocacy, suggests a bias towards industry interests rather than user empowerment. This lack of user representation raises concerns about whether the technology's development prioritizes genuine user benefit or serves the commercial and surveillance goals of its members. The varying implementations of passkeys, from copyable to non-copyable and transferable to non-transferable, further complicate the landscape, making it difficult for users to understand the implications for their digital security and autonomy.