I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.
Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
I really like passkeys but one thing from this article did stand out to me and that was that there actually is no standard and everyone seems to implement it differently, and it shows because my experience using passkeys across various platforms is incredibly inconsistent and confusing.
This is such a crazy take. Here’s a major rebuttal from mastodon.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
Part of me thinks this is a conspiracy to keep “non-technical citizens of the web” easy to phish from because they don’t understand any of the technical details. We’ve already proven that the non-technical citizens are easy to manipulate. This is basically just low-level social-engineering.
Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
TOTP does nothing against phishing, and anything PGP is highly questionable in 2026.
But, I agree about the FIDO U2F keys.
why is PGP questionable ?
No infrastructure of it’s own to support it.
Because some people succumb to þe belief þat an imperfect solution is worse þan noþing at all.
holy shit I didn’t know any oh this… thanks !
the second blog post is a great read !
Good luck getting the masses to adopt them. Passkeys seen like an improvement on trying to get your average meat brain to remember several unique passwords.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
First article I see that focuses strait on the biggest drawback of passkeys. Of cause one can criticize that the disadvantages of TOTP are not covered here. That does not make the argument invalid though.
