Essay argues passkeys are a trap and users lack ultimate control over them

An opinion essay on Substack titled 'Passkeys are a trap' argues that passkeys, whatever their security benefits, are not built around the user's interests. The author concedes that passkeys can be far more secure than passwords and may indeed be more convenient, then says that is not the whole story: unlike any other kind of login credential, users do not have ultimate control over their passkeys. Passwords can be written down wherever you choose, authenticator apps are largely interchangeable, and a physical security key can be handed to a colleague you trust. Passkeys, the author says, come with a hidden dial that lets websites gradually remove that freedom. The author promises to explain how this works further down; that explanation is not in the available text.

The essay starts with who is behind passkeys. The author says they are the invention of the FIDO Alliance, a consortium of competing interests: Big Tech, little tech, national governments, intelligence agencies, banks, public institutions and a handful of nonprofits such as Mozilla. The author glosses each member's motive: Big Tech wants to sell more ads, intelligence agencies want to track everyone, banks want to be free of indemnity, little tech wants cheap solutions to reduce liability, and Mozilla wants to avoid having to die on any particular hill. The author makes no claim that these are bad motivations, but notes that no consumer advocacy groups are members. The contrast offered is the World Wide Web Consortium, which has public interest groups, universities and Tim Berners-Lee, whom the author describes as the British computer scientist who invented the World Wide Web in 1989.

The author agrees with the public case for passkeys on one point: passwords are insecure. Examples given are SolarWinds servers famously found to be using the password solarwinds123, and Hawaii's Emergency Management Agency accidentally revealing a password via a sticky note visible in a photograph. Passwords still have virtues, though: they are intuitive, and you choose where to keep them and whom to share them with. The author argues that better mechanisms than passwords already exist and that the FIDO Alliance seems to be giving them the cold shoulder. First came two-factor authentication by text message or email, then the sturdier Time-Based One-Time Passwords (TOTP), commonly called authenticator apps.

TOTP gets a long defence. An authenticator generates a random-looking number every 30 seconds from the current time and a per-user seed, with no need for text messages, email or even the internet. It rests on an open standard, RFC 6238, so no particular app is required: in almost all cases you do not need Google Authenticator just because a website suggests it, and you can use a laptop or even a 90s Game Boy. A leaked code, for instance in a photo of your desk, puts you at risk only for a couple of minutes until it expires. All TOTP codes are equally hard to guess, and you can send a code or even the seed to a friend. Netflix, the author notes in a running aside, does not want you to share your passwords or your TOTP keys.

Passkeys look similar on the surface, since they also have an open standard, WebAuthn. The author reports generating a passkey with free and open source software, emailing it to a friend, and both of them then accessing the same website with it, without asking permission from the website or the FIDO Alliance. That, the author says, is indeed convenient. The catch is that something else is also called a passkey, and it is nothing like that kind. The author says many different things are called passkeys and that the FIDO Alliance intentionally gave them all the same name, which the author believes was done to deliberately confuse users. The WebAuthn standard itself barely uses the word, instead speaking of discoverable and undiscoverable credentials, hardware-backed and software-backed credentials, and attested and unattested credentials. The author says the specs read less like a standard and more like a parts catalogue.

The catalogue the available text covers has three pairs. Copyable versus non-copyable: a non-copyable passkey guarantees nobody else can access your account while you hold your device, but a copyable one can be shared between your devices; the author warns you will have a bad time if you mistake one for the other, either unable to rescue your only passkey from a dying laptop or unaware that someone holds a copy. Transferable versus non-transferable: even a non-copyable passkey can be transferable, so that sending it to someone makes it disappear from your own device, which can help when you replace your phone but defeats the point if you wanted one specific device to be required. Hardware-backed versus software-backed: hardware-backed passkeys use the secure chip in modern devices, such as a Trusted Platform Module on a laptop or the Secure Enclave on an iPhone, which can hold data that cannot be exfiltrated. The author says the consensus seems to be that these cryptoprocessors are very secure. The text ends as the author begins to ask whether someone with the know-how could open the chip.

Key facts

• The essay's central claim: unlike passwords, authenticator apps or physical security keys, passkeys do not give users ultimate control, and the author says passkeys come with a hidden dial that lets websites gradually remove users' freedom.
• The author credits passkeys to the FIDO Alliance, a consortium of Big Tech, little tech, governments, intelligence agencies, banks, public institutions and some nonprofits such as Mozilla, and notes that no consumer advocacy groups are members.
• TOTP authenticator apps are praised as a better alternative: a new code every 30 seconds, an open standard (RFC 6238), no specific app needed, and a leaked code is a risk for only a couple of minutes.
• The author says many different things are all called 'passkeys' (copyable or non-copyable, transferable or non-transferable, hardware-backed or software-backed) and believes the shared name was meant to confuse users.
• The author concedes passkeys can be far more secure than passwords and may be more convenient, and agrees that passwords are insecure.

Why it matters

Websites are increasingly pushing users from passwords to passkeys, usually on the grounds of security and convenience. This essay supplies the counterargument: the author does not dispute the security gain but says that control over the credential is what is at stake. The point is framed through a comparison. Passwords, TOTP authenticator apps and physical security keys can each be stored, chosen or handed over as the user likes, while passkeys, in the author's telling, carry a hidden dial websites can turn to take that freedom away. The author also questions who designed the scheme, pointing to the FIDO Alliance's membership, which includes intelligence agencies, banks and Big Tech but no consumer advocacy groups.

Who it affects

Anyone being asked by a website to replace a password with a passkey, and anyone who currently relies on passwords or authenticator apps and wants to understand what changes. The essay is aimed at general users rather than specialists, and explains terms such as TOTP, seeds and cryptoprocessors along the way. It also bears on sites and platforms that issue passkeys, since the author argues they are the ones holding the dial.

How to use it

This is an opinion piece, not a product, so there is nothing to install. The practical points the author makes: if you create a passkey, make sure you know whether it is copyable or non-copyable, because mistaking one for the other leads either to losing your only passkey with a dying laptop or to someone holding a copy you did not know about. Know also whether it is transferable and whether it is hardware-backed. For authenticator apps, the author notes that TOTP follows the open standard RFC 6238, so in almost all cases you do not need to use Google Authenticator just because a website suggests it, and any software and hardware that can keep time and run a few lines of code will do.

How solid is it

This is a personal opinion essay, and its claims are the author's own. The concrete technical descriptions (TOTP generating a code every 30 seconds, the open standards RFC 6238 and WebAuthn, the copyable, transferable and hardware-backed distinctions) are presented plainly and match how the author describes them. The strongest assertions are interpretive: that users lack ultimate control, that FIDO named every variant 'passkey' on purpose, and that websites can gradually remove control. The author states the naming motive as a belief. The available text ends partway through the section on hardware-backed passkeys, so the author's explanation of how websites remove control, and any conclusion or recommendation, are not visible. The author's name and the publication date are not given.

Risks and caveats

The essay is one-sided by design: the author argues for TOTP and against passkeys, while conceding passkeys can be far more secure than passwords. No named website is shown actually restricting passkeys or removing user control over them in the available text, and no evidence is offered beyond the author's belief that FIDO chose the shared name to confuse users. No statistics on passkey adoption, breaches or phishing are given. The author also says he makes no claim that the motivations of FIDO members are bad, so the argument rests on the absence of user representation rather than on accusations. The author's own passkey experiment, emailing a passkey to a friend, shows one kind of passkey is freely shareable, which sits uneasily with the headline claim until the later sections are read.

“Passkeys are not designed to prioritize your interests.”

— the essay's author, 'Passkeys are a trap'