• The Promise vs. Reality of Passkeys:

  • Passkeys (built atop WebAuthn / FIDO2) are marketed as the ultimate replacement for passwords, promising phishing resistance, cryptographic security, and seamless authentication without shared secrets.
  • Despite the technical merits of public-key cryptography, the real-world user experience introduces severe friction, vendor lock-in, and conceptual opacity for everyday users.

• Ecosystem Fragmentation & Platform Walled Gardens:

  • Major platform holders (Apple, Google, Microsoft) implement passkey synchronization within their proprietary ecosystems (iCloud Keychain, Google Password Manager, Windows Hello).
  • Cross-platform authentication often forces cumbersome workarounds—such as scanning QR codes via Bluetooth proximity between incompatible devices—which frequently fails or degrades user trust.

• Account Recovery & Portability Concerns:

  • Unlike passwords or traditional exportable 2FA seeds (TOTP), passkeys have historically lacked standardized, platform-agnostic import/export mechanisms, making migration between ecosystems painful or impossible.
  • Account recovery becomes high-risk: losing access to an ecosystem account can lead to permanent lockout from third-party services that disabled password fallbacks.

• Shared Accounts and Non-Technical User Barriers:

  • Standard family and enterprise account-sharing patterns (e.g., streaming services, joint utility bills, shared team logins) break down when an authentication credential is bound to a single person's device ecosystem.
  • For non-technical users, abstracting authentication into platform prompts removes transparency regarding where credentials physically reside or how to back them up securely.

Hacker News Discussion

• Platform Enclosure & Loss of User Agency:

  • Commenters frequently point out that passkeys shift control from open protocols and user-owned password managers to big-tech operating system silos.
  • Many express frustration that the underlying cryptography is solid, but the implementation incentives serve corporate lock-in rather than user autonomy.

• Cross-Device Usability Failures:

  • Real-world usage stories highlight significant pain points when operating across mixed environments (e.g., a Linux desktop, an Android phone, and a work MacBook).
  • The hybrid transport mechanism (QR code + Bluetooth LE handshake) is widely criticized as fragile, slow, and confusing for mainstream users.

• Third-Party Password Managers as the Middle Ground:

  • Several participants advocate for managing passkeys exclusively inside dedicated third-party tools (such as 1Password, Bitwarden, or KeePassXC) rather than OS keychains.
  • This approach restores cross-platform synchronization and export capabilities, though some note it circumvents the hardware-isolated enclave guarantees intended by platform vendors.

• Phishing Resistance Still Outweighs UX Defects:

  • Security practitioners in the thread defend passkeys, stressing that origin-bound cryptographic credentials completely eliminate credential stuffing, phishing, and server-side database leaks.
  • Even with awkward UX, defenders argue that passkeys represent an unavoidable and strictly superior baseline compared to weak passwords and easily intercepted SMS 2FA.

Passkeys and Consumer Usability

• Nikita Bier's Post:
  • Asserts that passkeys were created by engineers who failed to understand the average consumer's mindset and mental model.
  • Argues that despite their cryptographic security, passkeys create unnecessary friction and confusion for non-technical users compared to passwords.

Hacker News Discussion

• Cross-Platform & Multi-Device Friction:
  • Users navigating multiple operating systems (macOS, Windows, iOS) and browsers find passkey synchronization confusing and unpredictable.
  • Platform-level implementations often push users into specific vendor ecosystems, complicating cross-device workflows.
• Loss of User Control & Data Transparency:
  • Unlike passwords, passkeys cannot be easily copied, pasted, or manually inspected, raising fear of accidental account lockouts.
  • Proprietary or ecosystem-locked implementations make exporting passkeys difficult, driving concerns over vendor lock-in.
• Shared Account & Family Access Barriers:
  • Credentials meant to be shared across family members or households (e.g., utility accounts or streaming services) become hard to manage when bound to individual passkeys.
• Confusing User Experience & Conflicting Dialogs:
  • Operating systems, browsers, and third-party password managers (like Bitwarden or 1Password) frequently compete for authentication handling, leading to confusing popups and prompts.
• Security vs. Practical Adoption:
  • While passkeys solve major security vulnerabilities like phishing, the gap in user comprehension leads many experienced tech workers and consumers to stick with traditional password managers.

• The Problem with Passwords: Traditional password-based authentication is inherently insecure, vulnerable to phishing, malware (keyloggers), man-in-the-middle attacks, and massive database breaches.
• What are Passkeys: Passkeys are a marketing term for Web Authentication (WebAuthn) credentials. They use public-key cryptography to authenticate users, where the private key stays on the user's device and the public key is stored by the service.
• Phishing Resistance: Because private keys are never transmitted over the network and are cryptographically bound to specific domains, passkeys are effectively immune to traditional phishing attacks.
• Improved UX and Security: Passkeys offer a superior user experience (e.g., using biometrics or device-bound keys) while significantly reducing the risk of credential theft for both the user and the service provider.
• Key Management: Passkeys can be stored in synced password managers or bound to specific hardware security keys. Even if a device is lost, users can manage their accounts through recovery plans, similar to how they manage existing password managers.
• Transition Strategy: The author argues that for true security, companies should move to a "passkey-first" approach, eventually removing passwords entirely and using one-time codes or magic links as a fallback during the transition.
• Future-Proofing: While current passkeys are susceptible to future quantum computing threats, the industry is already looking toward post-quantum signature schemes to ensure long-term security.

• Core Argument: Passkeys are excellent for phishing-resistant authentication, but using them as the primary key for data encryption (via the PRF extension) creates a "disaster waiting to happen."
• The "Blast Radius" Problem: Overloading a passkey for encryption significantly increases the risk. If a user loses or deletes their passkey, they don't just lose access to an account—they permanently lose the underlying data (photos, documents, crypto wallets, etc.).
• User Misunderstanding: Most users do not realize that deleting a passkey from a manager (like Apple, Google, or Bitwarden) is equivalent to destroying the encryption key for their backed-up data.
• Recovery Failures: In scenarios where a user recovers an account via phone or email, they may successfully log in but will be unable to decrypt their history/backups without the original passkey, leading to irreversible data loss.
• Appropriate Use Cases: The PRF (Pseudo-Random Function) extension is legitimate when used for "durable" purposes, such as unlocking credential managers that have separate robust recovery mechanisms (master passwords, recovery keys).
• Call to Action for Industry:
  • Identity Industry: Stop promoting passkeys as a primary encryption tool for user data.
  • Credential Managers: Implement explicit warnings when a user attempts to delete a passkey that utilizes PRF.
  • Service Providers: If using PRF, provide clear documentation (e.g., via prfUsageDetails endpoints) and warn users during the setup process that the passkey is tied to data access.

[[Alper Cugun p]] on why he does not use passkeys

Good list of issues in this article. This issue of Credential Exchange Protocol / Format is so key to me, and so timely for this article, since the initial 1.0 was done a year ago. AFAIK there aren't implementations yet, Passkeys are locked on a device.