A new report published on the nonfunctional.substack.com newsletter has reignited the debate over passkeys, calling them a trap that could erode user control over digital identities. The article, titled 'Passkeys are a trap. Do not use them.', argues that while passkeys are more secure than passwords, they are not designed with the user's best interests in mind.
The report comes as more websites and services push passkeys as the default login method, promising convenience and enhanced security. However, the author warns that the technology, developed by the FIDO Alliance, involves a hidden mechanism that allows websites to gradually restrict how users manage their credentials.
The FIDO Alliance and Its Members
The FIDO Alliance, which invented passkeys, is a consortium that includes Big Tech companies, national governments, intelligence agencies, banks, and even nonprofits like Mozilla. According to the report, each member has its own agenda: Big Tech seeks more ad revenue, intelligence agencies want global tracking, banks aim to reduce liability, and smaller tech firms want cheap solutions.
Notably, no consumer advocacy groups are part of the FIDO Alliance, unlike the World Wide Web Consortium (W3C), which includes public interest groups and universities. The report suggests that without such voices, the user's interests are not strongly represented in the development of passkeys.
Why Passwords Are Still Preferred by Some
The report acknowledges that passwords are insecure, citing examples like SolarWinds using 'solarwinds123' and a sticky note exposing a password at Hawaii's Emergency Management Agency. However, it highlights that passwords offer intuitive control: users can choose where to store them and whom to share them with.
In contrast, passkeys remove that ultimate control, according to the author. With passkeys, a hidden dial lets websites gradually limit what users can do with their credentials, a feature that is not present with passwords, authenticator apps, or physical security keys.
