244
Passkeys are a trap. Do not use them
(nonfunctional.substack.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Oct 2026
244 points (83.2% liked)
Privacy
51397 readers
619 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
I don't see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn't make them "traps".
Ooohh, don’t think corpos and banks won’t go for that hypothetical. A lot of apps already turn haywire if you have developer options enabled, accessibility options enabled, have a specific installed or using a custom ROM. If the optional attestation is enforced by your bank that they only accept passkeys from google’s password manager or apple passwords, then using something like Keepass or Bitwarden isn’t an option.
Look… I love passkeys. They are convenient and more secure. But if a service cares about on what device and software it was created then it is pointless and just an ecosystem lockdown mechanism.
Also, like, if it doesn't allow me to set up a passkey because my manager or OS is not supported...I guess I'm not setting up a passkey then, which is OK by me, so there is no problem.
No problem until they make every other method more and more difficult. Which is already happening.
I only use passkeys when the alternative is an onerous song and dance.
The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won't let you just use any old authenticator app. You need the "special" one that sucks ass. So maybe they'll do the same to passkeys, but for normal users I don't think they'd do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.