https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
Passkeys are a trap. Do not use them.
Intended audience: non-technical citizens of the web
The Hack
Oct 10, 2026
*** begin quote ***
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them and to use them with the devices and software you prefer.
*** and ***
In fact there are many different things called “passkeys” and the FIDO Alliance has intentionally named all of them the same thing. I believe this was done in order to deliberately confuse users and encourage them not to look too closely at the fine text. Indeed, in the technical documentation, the WebAuthn standard that defines passkeys barely uses the term passkey at all. Instead there are discoverable credentials and undiscoverable credentials; there are hardware-backed credentials, and software-backed credentials; there are attested and unattested credentials, and more and more.
*** end quote ***
This is fine mess. And a plague on all their houses. It has to be deliberate. Creates a security scheme that can be exploited. Shame on them.
I got locked in at McD’s but using “Sign on with Apple” and now I can move the account.
Sigh!
— 30 —
