Seems like every website wants us to stop using passwords. There is a replacement we are being asked to use instead called passkeys. This should be a tad concerning if passwords are familiar to you and you don’t fully understand these nebulous passkeys.
Websites say that passkeys are more secure or more convenient or something similarly beneficial. While it is true that passkeys can be far more secure than passwords, and may indeed be more convenient, that’s not the whole story. Passkeys are not designed to prioritize your interests. Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.
The part worth arguing about isn’t the crypto, it’s the sync.
Passkeys are just WebAuthn/FIDO2 credentials (W3C WebAuthn Level 3). The private key stays in the authenticator and is bound to the site’s origin, so a lookalike login page has nothing to steal. That isn’t marketing, it’s the design, and it’s why they beat passwords and SMS codes at phishing.
Where the “trap” framing does have teeth: the default consumer passkey is a syncable authenticator, copied into Apple’s, Google’s or Microsoft’s keychain (or a password manager) so it works on a new phone. NIST SP 800-63B-4 is blunt about that: syncable authenticators are inherently exportable and SHALL NOT be used at AAL3, only AAL2. So “more secure than a password” is solidly true for a hardware token and only conditionally true for the synced one in your pocket.
The lock-in complaint is the strongest point, and also the one aging fastest. Portability used to be the hole. FIDO has since published Credential Exchange Specifications, and Dashlane (Android) plus Bitwarden (iOS 26) are shipping it. Moving a passkey between providers is being built, not impossible forever.
The honest trade is recovery. With a password you hold the backup. With a synced passkey the backup lives in a platform account, so the attack moves from “guess your secret” to “take over the account that holds it.”
Open question for the thread: past sync custody, what’s the concrete attack? I can’t name a way an origin-bound passkey gets phished or silently forced on you. If someone can, that’s the actual story.
Passkeys as a single factor auth are also less secure. They don’t even replace your password/2fa login because you need to log in on other devices, so adding passkeys will just increase the attack surface.
I’m going to stick with randomized passwords in my own offline password manager plus 2fa. Sue me.
Great article to help understand passkeys and why not to use them.
I’ve skirted away from passkeys for years because I didn’t understand them, and admittedly, I never tried. I use a password manager, strong random passwords, and 2FA in most places where possible. (I have objections to SMS based 2FA, but that’s a different topic.
Reflecting a bit, as hard as sites “push” use a passkey, it sets off the spidey-senses. Oh, it’s so they have more control over you, your account, and your hardware… (not always, but pinky promise we/microsoft/netflix/google/apple would never restrict/impact your selection of applications or hardware outside of our control.)
While the OP sounds a bit conspiratory, there is a spark of truth in there. Passkeys are much more limited in the way they move between devices (if at all).
Having a passkey on your PC also invalidates many of the “comfort” use cases of them, since you cannot easily use your PC to authenticate a service on a different device, say your smartphone or a laptop, at least you couldn’t when I last checked. If that’s possible nowadays please correct me.
OP sounds like they have seen a plot twist or two during their time on this planet
Most passkeys reside in a password manager. It’s up to the password manager to sync keys between devices.
You can use Google’s password sync for this, or Apple’s, or Microsoft’s, or the plethora other password managers that support passkeys.
I personally sync mine to my VaultWarden instance to keep cross platform compatibility.
You can use your smartphone to authenticate on your PC (as long as both have Bluetooth, I think), or you could buy two hardware tokens from one of the vendors on the market.