• Debunking attestation fears: The claim that passkeys will enable consumer sites to block rooted devices, custom OSs, or specific software via attestation is technically unfounded:
  • Standard synced passkeys (e.g., iCloud Keychain, Google Password Manager, Bitwarden, 1Password) return no attestation statement (attestation: none) to websites.
  • Mandating attestation would instantly lock out the vast majority of consumers, and W3C/FIDO guidelines have explicitly advised consumer sites against requesting it for years.
  • WebAuthn attestation only verifies the authenticator make and model via its AAGUID; it conveys zero telemetry about the host OS, browser extensions, firmware version, or jailbreak status.
• Flawed advice regarding hardware keys: Advising users to adopt hardware tokens (like YubiKeys) to escape attestation is contradictory, as physical tokens are the authenticators that actually include vendor-signed attestation certificates.
• The critical flaw of TOTP: Falling back to passwords and TOTP codes leaves users vulnerable to real-time reverse-proxy phishing kits (such as Evilginx), whereas passkeys are cryptographically domain-bound and inherently phishing-resistant.
• Core recommendation: Users should adopt passkeys stored in trustworthy password managers to maximize phishing protection, rather than reverting to inferior legacy authentication methods over speculative dystopian scenarios.

Hacker News Discussion

• Usability fragmentation and platform silos:
  • Many commenters argue that while the underlying cryptography is sound, passkeys remain a user-experience disaster across heterogeneous operating systems and browsers.
  • Managing passkeys across differing platforms (Windows, macOS, iOS, Android) often routes credentials into competing native ecosystem silos (Apple Keychain, Google Password Manager, Samsung) unless a dedicated third-party manager is configured.
• Inconsistent and poor website implementations:
  • Users noted that many websites implement WebAuthn improperly—failing to support multiple registered passkeys, disallowing cross-device Bluetooth flows, or insisting on fallback SMS/email codes anyway, which negates the primary convenience advantage.
• Phishing resistance vs. user control:
  • Commenters debated whether passkeys primarily benefit service providers rather than end users. Proponents emphasized that passkeys eliminate the human error of copy-pasting credentials into typosquatted phishing domains.
  • Skeptics voiced concerns about vendor lock-in, recovery headaches, and losing the straightforward manual portability offered by plaintext passwords stored in open-source password managers with TOTP.

• The Core Argument: While passkeys are marketed as a secure and convenient replacement for passwords, they give websites and tech giants a hidden mechanism to control user behavior and restrict user freedom.
• Lack of Consumer Representation: Passkeys are created by the FIDO Alliance—a consortium of Big Tech, banks, and intelligence agencies—with no consumer advocacy groups involved to protect everyday users.
• Comparison with Passwords and TOTP:
  • Traditional passwords are intuitive and allow users full control over storage and sharing.
  • Time-Based One-Time Passwords (TOTP / authenticator apps) use open standards, allowing complete freedom in software/hardware choice (even running on a 90s Game Boy) and easy code sharing.
• The Fragmented Standard: The FIDO Alliance lumps many distinct security mechanisms under the single name "passkeys," including choices between copyable/non-copyable, transferable/non-transferable, hardware-backed/software-backed, and user-verified/non-user-verified credentials.
• The Danger of Remote Attestation:
  • Passkeys support remote attestation flags that require devices, operating systems, and passkey managers to cryptographically prove their configuration to websites.
  • This enables platforms (like Twitter/X or Netflix) to reject custom, open-source, or non-approved software (such as Linux or customized phone operating systems), effectively locking users into corporate ecosystems.
• Broader Implications: Remote attestation could eventually be used to enforce ID verification, mandate AI content scanners, block browser extensions (like ad-blockers), and restrict digital sovereignty.
• Alternative Recommendations: The author suggests sticking to TOTP or utilizing physical security keys (like a YubiKey) which provide strong security without forcing whole-operating-system lockdown.

Hacker News Discussion

• Attestation Scope and Enforcement: Commenters debated whether consumer platforms would realistically adopt and enforce strict attestation. While some argued it is unlikely for standard consumer apps because most users lack specialized hardware keys, others pointed out that modern devices (iOS, Android, Windows) have secure enclaves and secure boot foundations ready to enforce it.
• Real-World Precedent: A user highlighted that in Japan, the Financial Services Agency (FSA) already mandates passkey authentication for brokerages, restricting allowed hardware and blocking standard FIDO2 hardware keys in favor of platform-locked solutions like Windows Hello or iOS Passwords.
• Mobile Ecosystems and Rooting: Android users noted that mobile device attestation is already a widespread headache for custom ROM and root users (e.g., via SafetyNet/Play Integrity breaking banking apps), though some distinguished this from web-based passkeys.
• Loss of Openness: Several participants expressed deep frustration over companies and banks forcing users to relinquish control over their hardware and software as a mandatory precondition for participating in modern society.

• The Promise vs. Reality of Passkeys:

  • Passkeys (built atop WebAuthn / FIDO2) are marketed as the ultimate replacement for passwords, promising phishing resistance, cryptographic security, and seamless authentication without shared secrets.
  • Despite the technical merits of public-key cryptography, the real-world user experience introduces severe friction, vendor lock-in, and conceptual opacity for everyday users.

• Ecosystem Fragmentation & Platform Walled Gardens:

  • Major platform holders (Apple, Google, Microsoft) implement passkey synchronization within their proprietary ecosystems (iCloud Keychain, Google Password Manager, Windows Hello).
  • Cross-platform authentication often forces cumbersome workarounds—such as scanning QR codes via Bluetooth proximity between incompatible devices—which frequently fails or degrades user trust.

• Account Recovery & Portability Concerns:

  • Unlike passwords or traditional exportable 2FA seeds (TOTP), passkeys have historically lacked standardized, platform-agnostic import/export mechanisms, making migration between ecosystems painful or impossible.
  • Account recovery becomes high-risk: losing access to an ecosystem account can lead to permanent lockout from third-party services that disabled password fallbacks.

• Shared Accounts and Non-Technical User Barriers:

  • Standard family and enterprise account-sharing patterns (e.g., streaming services, joint utility bills, shared team logins) break down when an authentication credential is bound to a single person's device ecosystem.
  • For non-technical users, abstracting authentication into platform prompts removes transparency regarding where credentials physically reside or how to back them up securely.

Hacker News Discussion

• Platform Enclosure & Loss of User Agency:

  • Commenters frequently point out that passkeys shift control from open protocols and user-owned password managers to big-tech operating system silos.
  • Many express frustration that the underlying cryptography is solid, but the implementation incentives serve corporate lock-in rather than user autonomy.

• Cross-Device Usability Failures:

  • Real-world usage stories highlight significant pain points when operating across mixed environments (e.g., a Linux desktop, an Android phone, and a work MacBook).
  • The hybrid transport mechanism (QR code + Bluetooth LE handshake) is widely criticized as fragile, slow, and confusing for mainstream users.

• Third-Party Password Managers as the Middle Ground:

  • Several participants advocate for managing passkeys exclusively inside dedicated third-party tools (such as 1Password, Bitwarden, or KeePassXC) rather than OS keychains.
  • This approach restores cross-platform synchronization and export capabilities, though some note it circumvents the hardware-isolated enclave guarantees intended by platform vendors.

• Phishing Resistance Still Outweighs UX Defects:

  • Security practitioners in the thread defend passkeys, stressing that origin-bound cryptographic credentials completely eliminate credential stuffing, phishing, and server-side database leaks.
  • Even with awkward UX, defenders argue that passkeys represent an unavoidable and strictly superior baseline compared to weak passwords and easily intercepted SMS 2FA.

Passkeys and Consumer Usability

• Nikita Bier's Post:
  • Asserts that passkeys were created by engineers who failed to understand the average consumer's mindset and mental model.
  • Argues that despite their cryptographic security, passkeys create unnecessary friction and confusion for non-technical users compared to passwords.

Hacker News Discussion

• Cross-Platform & Multi-Device Friction:
  • Users navigating multiple operating systems (macOS, Windows, iOS) and browsers find passkey synchronization confusing and unpredictable.
  • Platform-level implementations often push users into specific vendor ecosystems, complicating cross-device workflows.
• Loss of User Control & Data Transparency:
  • Unlike passwords, passkeys cannot be easily copied, pasted, or manually inspected, raising fear of accidental account lockouts.
  • Proprietary or ecosystem-locked implementations make exporting passkeys difficult, driving concerns over vendor lock-in.
• Shared Account & Family Access Barriers:
  • Credentials meant to be shared across family members or households (e.g., utility accounts or streaming services) become hard to manage when bound to individual passkeys.
• Confusing User Experience & Conflicting Dialogs:
  • Operating systems, browsers, and third-party password managers (like Bitwarden or 1Password) frequently compete for authentication handling, leading to confusing popups and prompts.
• Security vs. Practical Adoption:
  • While passkeys solve major security vulnerabilities like phishing, the gap in user comprehension leads many experienced tech workers and consumers to stick with traditional password managers.

• The Problem with Passwords: Traditional password-based authentication is inherently insecure, vulnerable to phishing, malware (keyloggers), man-in-the-middle attacks, and massive database breaches.
• What are Passkeys: Passkeys are a marketing term for Web Authentication (WebAuthn) credentials. They use public-key cryptography to authenticate users, where the private key stays on the user's device and the public key is stored by the service.
• Phishing Resistance: Because private keys are never transmitted over the network and are cryptographically bound to specific domains, passkeys are effectively immune to traditional phishing attacks.
• Improved UX and Security: Passkeys offer a superior user experience (e.g., using biometrics or device-bound keys) while significantly reducing the risk of credential theft for both the user and the service provider.
• Key Management: Passkeys can be stored in synced password managers or bound to specific hardware security keys. Even if a device is lost, users can manage their accounts through recovery plans, similar to how they manage existing password managers.
• Transition Strategy: The author argues that for true security, companies should move to a "passkey-first" approach, eventually removing passwords entirely and using one-time codes or magic links as a fallback during the transition.
• Future-Proofing: While current passkeys are susceptible to future quantum computing threats, the industry is already looking toward post-quantum signature schemes to ensure long-term security.

• Core Argument: Passkeys are excellent for phishing-resistant authentication, but using them as the primary key for data encryption (via the PRF extension) creates a "disaster waiting to happen."
• The "Blast Radius" Problem: Overloading a passkey for encryption significantly increases the risk. If a user loses or deletes their passkey, they don't just lose access to an account—they permanently lose the underlying data (photos, documents, crypto wallets, etc.).
• User Misunderstanding: Most users do not realize that deleting a passkey from a manager (like Apple, Google, or Bitwarden) is equivalent to destroying the encryption key for their backed-up data.
• Recovery Failures: In scenarios where a user recovers an account via phone or email, they may successfully log in but will be unable to decrypt their history/backups without the original passkey, leading to irreversible data loss.
• Appropriate Use Cases: The PRF (Pseudo-Random Function) extension is legitimate when used for "durable" purposes, such as unlocking credential managers that have separate robust recovery mechanisms (master passwords, recovery keys).
• Call to Action for Industry:
  • Identity Industry: Stop promoting passkeys as a primary encryption tool for user data.
  • Credential Managers: Implement explicit warnings when a user attempts to delete a passkey that utilizes PRF.
  • Service Providers: If using PRF, provide clear documentation (e.g., via prfUsageDetails endpoints) and warn users during the setup process that the passkey is tied to data access.

[[Alper Cugun p]] on why he does not use passkeys

Good list of issues in this article. This issue of Credential Exchange Protocol / Format is so key to me, and so timely for this article, since the initial 1.0 was done a year ago. AFAIK there aren't implementations yet, Passkeys are locked on a device.