Author claims passkeys trap users by removing credential control
A viral post argues that passkeys, promoted by the FIDO Alliance, lack consumer advocacy and allow websites to limit user control over login credentials.
Key points
- An article on Hacker News argues passkeys are a trap because users lack ultimate control over them.
- The FIDO Alliance, which created passkeys, includes Big Tech and governments but no consumer groups.
- The author contrasts passkeys with passwords and security keys, which users can manage independently.
An article published on the Hacker News front page argues that passkeys are a trap that removes user control over login credentials. The post, which garnered significant attention with 296 points and 168 comments, warns non-technical citizens about the hidden risks of adopting this new authentication method.
The author contends that while websites promote passkeys as more secure or convenient than passwords, this narrative is incomplete. According to the article, passkeys are not designed to prioritize user interests. The writer compares passkeys to a Trojan Horse, describing them as elegant on the surface but troubling underneath. The core concern is that unlike other credentials, users do not have ultimate control over their passkeys.
The Mechanics of Control Loss
The article explains that traditional login methods allow users to dictate how credentials are managed. With passwords, users can choose where to write them down. Authenticator apps are described as interchangeable, allowing users to decide which ones to use. Physical security keys can be handed to trusted colleagues.
In contrast, the author states that passkeys include a hidden mechanism. This feature allows websites to gradually remove the user's ability to manage their credentials as they please. The article suggests that this loss of autonomy is a deliberate design choice rather than an accidental flaw. The author notes that this dynamic is fundamentally different from the user-centric control found in password or hardware key systems.
FIDO Alliance and Stakeholder Interests
Passkeys were invented by the FIDO Alliance, a consortium comprising competing interests. According to the source material, members include Big Tech companies, smaller tech firms, national governments, intelligence agencies, banks, public institutions, and nonprofits like Mozilla. The author notes that these diverse groups agree on passkeys as a righteous cause, despite having different motivations.
The article outlines specific interests for each group. Big Tech aims to sell more ads by introducing inconveniences. Intelligence agencies seek to track individuals globally. Banks want to avoid indemnity liabilities. Smaller tech companies desire cheap solutions to reduce liability. Mozilla is described as wanting to avoid taking a hard stand. The author emphasizes that no consumer advocacy groups are members of the FIDO Alliance. This stands in contrast to the World Wide Web Consortium, which also sets web standards.
What should you do?
The article does not provide a technical fix or a patch for the alleged design flaw. Instead, it urges readers to understand the implications before adopting passkeys. The author suggests that users should be concerned if they do not fully understand how passkeys work. The recommendation is to recognize that passkeys shift control from the user to the website. Readers are advised to consider whether they are comfortable with websites having the ability to limit their credential management options. The article implies that continuing to use passwords or physical keys may preserve more user autonomy.
What to do and how to stay safe: FIDO Alliance
- Review which services have enrolled passkeys and understand the recovery options provided by each site.
- Maintain access to physical security keys or backup codes for critical accounts to ensure independent control.
- Monitor updates from the FIDO Alliance regarding changes to passkey implementation standards.
- Evaluate whether the convenience of passkeys outweighs the loss of credential portability for specific accounts.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who created the passkey standard?
Passkeys were invented by the FIDO Alliance, a consortium including Big Tech, governments, banks, and nonprofits.
Why does the author call passkeys a trap?
The author argues passkeys are a trap because they allow websites to gradually remove user control over login credentials.
Are consumer advocacy groups involved in passkey standards?
No, the article states that no consumer advocacy groups are members of the FIDO Alliance.
