Author argues passkeys lack user control and serve FIDO Alliance interests
A new analysis claims passkeys are a trap that removes ultimate user control, contrasting them with passwords and physical security keys.
Key points
- The author argues passkeys allow websites to gradually remove user control over credentials.
- The FIDO Alliance, which invented passkeys, includes Big Tech and intelligence agencies but no consumer groups.
- Critics note that unlike passwords or authenticator apps, users cannot easily choose or transfer passkey management.
A recent article published on Substack and discussed on Hacker News argues that passkeys are a trap for non-technical web users. The author contends that while passkeys offer security benefits, they fundamentally shift control away from the user toward service providers and the organizations that created the standard. This perspective challenges the prevailing industry narrative that passkeys are an unqualified improvement over passwords.
The central claim is that users do not possess ultimate control over their passkeys, unlike with other login credentials. With passwords, individuals can choose where to store them, and with authenticator apps, users can select interchangeable tools. Physical security keys can be handed to trusted colleagues. Passkeys, however, include a mechanism that allows websites to gradually restrict how users manage these credentials, according to the analysis.
The FIDO Alliance and Conflicting Interests
Passkeys were invented by the FIDO Alliance, a consortium comprising Big Tech companies, smaller tech firms, national governments, intelligence agencies, banks, and nonprofits like Mozilla. The author notes that these members have divergent motivations. Big Tech seeks to introduce inconveniences to sell more ads, while intelligence agencies aim to track global users. Banks desire freedom from indemnity, and smaller tech firms want cheap liability reduction.
The article highlights that no consumer advocacy groups are members of the FIDO Alliance. This stands in contrast to the World Wide Web Consortium, which sets web standards and includes broader representation. The absence of consumer advocates in the group designing passkeys is presented as a significant concern for user interests.
Who Is Affected by This Shift?
The intended audience for this warning is non-technical citizens of the web who are being urged to abandon passwords. The author suggests that if users do not fully understand passkeys, they should be concerned about adopting them. The argument is that the elegance of passkeys masks a troubling interior, similar to a Trojan Horse, where the surface benefits hide underlying risks to user autonomy.
While passkeys can be more secure and convenient than passwords, the author insists this is not the whole story. The design prioritizes the interests of the FIDO Alliance members rather than the end users. This includes entities like Mozilla, which the author claims avoids taking strong stands on specific issues.
What should you do?
Readers are advised to consider the trade-offs between convenience and control when adopting new authentication methods. The article suggests that understanding the lack of ultimate control over passkeys is crucial before switching from familiar password systems. Users should evaluate whether the security benefits outweigh the loss of ability to choose or transfer their credential management tools.
What to do and how to stay safe: FIDO Alliance
- Review current authentication methods to understand which rely on passkeys versus passwords or physical keys.
- Investigate the specific control mechanisms offered by websites that require passkey usage for account recovery.
- Consider maintaining password-based access for critical accounts until user control over passkeys is clearer.
- Monitor updates from the FIDO Alliance regarding consumer advocacy and standard changes.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why does the author call passkeys a trap?
The author argues passkeys are a trap because they remove ultimate user control, allowing websites to restrict how credentials are managed.
Who invented passkeys?
Passkeys were invented by the FIDO Alliance, a consortium of tech companies, governments, banks, and nonprofits.
Are consumer groups part of the FIDO Alliance?
No, the author notes that no consumer advocacy groups are members of the FIDO Alliance.
