20
Passkeys are a trap. Do not use them.
(nonfunctional.substack.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Oct 2026
20 points (79.4% liked)
Security
7052 readers
25 users here now
Confidentiality Integrity Availability
founded 6 years ago
MODERATORS
There’s a difference between FIDO2 standards, whereby Hardware Tokens, like yubikeys, are not a trap. Of course software derived passkeys are antithetical to privacy, due to their opportunities for abuse like Microsoft’s deployment of the FIDO2 standard.
I think the concern is more about the freedom for the user to be able to decide what keys to use and how.
In particular, the author seems to want to share 1 account with multiple people, and enforcing "User-Present User-Verified Non-Copyable Hardware-Backed passkey" as the only accepted method for a service would allow for services to start restricting account sharing more effectively.
The standard allows an infinite number of tokens
You can have an infinite number of tokens with a single YubiKey, but that's not the concern.
The issue is that a website can limit how many different passkeys you are allowed to register to a single account of their service.
So it does not matter if your device can provide infinite keys when the service only accepts one.
Right, then they’re opersting outside of the bounds of the Internet and should be appropriately shamed.
Yes, ideally that's what should happen.
In practice, I've seen way too many times big corpo getting away with anticonsumer practices because their mainstream audience is willing to put up with it.
Specially when they introduce it slowly (say.. they start by allowing a reasonable but fixed number of keys ..then they lower the limit but start putting a small fee for each additional key.. then they lower the limit to 1, increase the fee, etc).. they'll test the waters and try to reach a level that enough of the mainstream would accept to maximize the money they make.
Frog inna pot
You never had any fucking freedom in regards to these services. The article is a bug-scare and is just trash. You might as well rail against their requirements to include numbers and special-characters in passwords--"oh, that's infringing on my freedoms! Just yesterday you accepted my password of "password", but now it's no longer acceptable? Wow fascism! Telling people they need to have numbers and special-characters! This is a slippery slope. People rise up and don't put any numbers or special-characters in your passwords!" I can't deride enough the point of view that originated this article. It's the most brain-dead boomer point of view I've yet seen. An epitome of manchild that's endemic to tech.