Passkeys are a trap. Do not use them

You may lose access to your accounts if your passkey provider fails or if you don't understand the specific type of passkey you are using.

The article argues against the widespread adoption of passkeys, framing them as a potential trap for users. While acknowledging passkeys can be more secure and convenient than traditional passwords, the author contends they are not designed with user interests as the top priority. A key concern raised is the lack of ultimate user control over passkeys, unlike passwords or authenticator app-generated codes, where users can choose storage and usage methods. The FIDO Alliance, a consortium of tech companies, governments, and financial institutions, is pushing for passkey adoption, but notably lacks consumer advocacy groups. The author contrasts passkeys with Time-Based One-Time Passwords (TOTP) from authenticator apps, highlighting TOTP's open standard and user control over storage and sharing, even suggesting TOTP seeds can be shared. The core issue with passkeys, according to the article, is the ambiguity in their definition, with different types like 'copyable' vs. 'non-copyable' and 'transferable' vs. 'non-transferable' existing under the same umbrella term, leading to potential user confusion and loss of control.

The FIDO Alliance's composition, lacking consumer advocacy groups, suggests a potential misalignment with user interests. This organization, which includes Big Tech aiming for ad revenue, intelligence agencies seeking tracking capabilities, and banks looking to reduce liability, has developed a system that, while appearing secure, may centralize control away from the individual. The author implies that the complexity and varied implementations of passkeys, such as 'copyable' vs. 'non-copyable' and 'transferable' vs. 'non-transferable,' are intentionally obscured, preventing users from fully grasping the implications of their choices.

This situation creates a vulnerability where users might inadvertently grant more control to service providers than they intend, potentially leading to account lockouts or security breaches if the provider's infrastructure falters. Unlike older, more transparent authentication methods where users had direct control over storage and sharing, passkeys introduce a layer of abstraction that, according to the article, prioritizes corporate or governmental interests over user autonomy and explicit consent.