20
Passkeys are a trap. Do not use them.
(nonfunctional.substack.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Oct 2026
20 points (79.4% liked)
Security
7052 readers
2 users here now
Confidentiality Integrity Availability
founded 6 years ago
MODERATORS
I can only assume the article was written by a petulant child.
The author is bemoaning lack of agency on services they never had agency over. Twitter, Netflix, Google's Android et. al. are all private dictatorships. It is not up to you whether they implement user-defined passwords or some other mechanism of authentication. Already these commercial enterprises use more than just a password. They look at machine and browser behavior, yet there's not a peep about this 'background' analysis that determines whether a remote-computer can interact with the private-dictatorship's corporate computer-resources. It is just as authoritarian as any example they wrote about.
The entire rant is a rant against passkeys' security: they're secure and because they're secure they're bad. It's nonsensical text dressed up as, "but they might do nebulous bad things!" They're already doing bad things, yet like a child, the author doesn't want to change their behavior. They want to continue being a good little consumer piggy in the play-pen of surveillance-capitalism. You never had agency here: grow up. No one gives a shit if your consumer brain-dead mind can or can't share a Netflix password.
Government agencies are members of these associations because economies are becoming more and more dependent on software and computers: it's in their nations' interests to secure these digital systems.
Again, using Apple's iPhone, Google's Android or Microsoft's Windows is subjecting yourself to a private dictatorship. To then complain about something that annoys you whilst you continue to voluntarily subjugate yourself is absolutely moronic.
Nothing was written of hardware-passkeys. That is passkeys that reside on physical tokens. Passkeys are more secure than user-defined passwords; passkeys are more secure than user-defined passwords with a weak second-factor such as via e-mail or SMS; Passkeys are more secure than user-defined passwords with a TOTP code.
You can use hardware-passkeys on libre-computers, or mangled-mutts like Nura. This was conveniently not mentioned at all.
They talk about yubikeys in the footnote, which isn't the best place to talk about them. They do not rant about how passkeys are bad because they are secure, they neutrally explain all the cool features and then they explain attestation, which is the only part they don't like. Also, they don't say that they use Windows, Android, macOS and iOS themselves and bemoan the oligopoly; they say most people use these operating systems instead of librecomputers, and bemoan the oligopoly on behalf of other people who don't know better, or use windows because [general excuse for why people who aren't the author use windows]. It is perfectly consistent to think of the author themselves as well informed about what linux they as an individual can install. I think we can blame the author for not making the article about how to install libre software, but taking that it is about passkeys as a given, it explains which part of them is harmful to software freedom. Maybe they even should have said that using android is to voluntarily subjugate oneself. But the article is about what the author wants other people to do, even if they aren't explicit enough about that rejecting passkeys while using chrome is a temporary solution. They are the type of person that believes temporary solutions have value.
🫰🫰🫰
Edit: snaps