Passkeys Are a Trap: The Hidden Dial Inside an Elegant Technology

Websites are falling over themselves to get us off passwords and onto passkeys, promising more security and more convenience. The author of the Non-Functional blog concedes the point: technically, passkeys really are good. But, he warns, behind the elegant facade — like inside the Trojan Horse — sits a hidden mechanism that lets the sites you use gradually strip away your control over your own keys.

Who's behind it

Passkeys are the invention of the FIDO Alliance, a consortium uniting Big Tech, small tech, banks, governments and intelligence agencies. Each has its own motives, but they share one trait: not a single consumer advocacy group sits among the members. Nobody is there to argue the user's case.

Passwords are insecure — here the author agrees, recalling the famous solarwinds123 and the password caught on a sticky note in a photo. But that problem was long ago solved by TOTP one-time codes (the RFC 6238 standard): an open formula, any software you like — even a homemade Python script or a 1990s Game Boy. The key point is that you decide where to keep your keys and whom to share them with. (Netflix, he notes, would rather you didn't.)

One word, dozens of different things

On the surface passkeys resemble TOTP and also rest on an open standard (WebAuthn). But under a single word, FIDO has deliberately bundled many incompatible variants: copyable and non-copyable, transferable and non-transferable, hardware-backed (inside a secure cryptoprocessor) and software-backed, requiring a human present or biometrics — or requiring nothing at all. The spec reads less like a standard than a parts catalogue.

Attestation is where the trap springs

For now the choice of these properties is seemingly yours. But the standard forces your software to report to the site which features are enabled. So a service can demand exactly a "hardware-backed, non-copyable, user-verified" key. You can lie about this — except in one case: an attested key. Remote attestation cryptographically proves you're using an approved passkey manager on an approved operating system with approved firmware. Install LineageOS on an old phone instead of buying a new one, and the check fails — and you're locked out.

This, the author argues, is where the real motive of Big Tech and intelligence agencies lies: not convenience or security, but the power to stop you running unapproved software — an alternative browser with an ad blocker, Linux, a competitor's app. Attestation isn't mandatory almost anywhere yet, but the standard has already baked it into the ecosystem; once most users stop noticing the difference, the switch can simply be flipped.

What to do

The author urges readers not to rush into setting up passkeys and to wait for a more honestly defined alternative. And if you need security right now, TOTP (even on a Game Boy) or a hardware key like a YubiKey will do: it's also part of WebAuthn, but being self-contained, its attestation demands don't spill out and lock down your whole system.

Source: Hacker News