126
Passkeys are not a trap. Use them!
(hachyderm.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Oct 2026
126 points (74.8% liked)
Privacy
51431 readers
1080 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
The biggest problem I have with passkeys is big companies aren't implementing them to improve your security - they're implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it's good for me too, I'm not inclined to do these assholes any favors. It'll just make them sloppier and lazier on other elements of security and they'll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they're going to be used in the wild, and what companies are likely to do with them. That's what's going to affect vast majority of the people.
Using established and tested security implementations instead of rolling your own has been considered good practice since forever. It's not a bad thing.
It's not about the implementation - it's about what passkeys do and don't do.
Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says "We're using passkeys. We're secure. Fire the high priced developers and get me some interns who can use Claude."
TLDR: Passkeys are not a magic bullet and they aren't a game changer, and the false sense of security they push is dangerous.
I realy dont think that's a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company's cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.
And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.