20
Passkeys are a trap. Do not use them.
(nonfunctional.substack.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Oct 2026
20 points (79.4% liked)
Security
7052 readers
3 users here now
Confidentiality Integrity Availability
founded 6 years ago
MODERATORS
You can have an infinite number of tokens with a single YubiKey, but that's not the concern.
The issue is that a website can limit how many different passkeys you are allowed to register to a single account of their service.
So it does not matter if your device can provide infinite keys when the service only accepts one.
Right, then they’re opersting outside of the bounds of the Internet and should be appropriately shamed.
Yes, ideally that's what should happen.
In practice, I've seen way too many times big corpo getting away with anticonsumer practices because their mainstream audience is willing to put up with it.
Specially when they introduce it slowly (say.. they start by allowing a reasonable but fixed number of keys ..then they lower the limit but start putting a small fee for each additional key.. then they lower the limit to 1, increase the fee, etc).. they'll test the waters and try to reach a level that enough of the mainstream would accept to maximize the money they make.
Frog inna pot