Great read, I didn’t know that about passkeys. I don’t use them although I’ve been prompted to, I always find it weird when they ask you to use something with absolutely no explanation.
I agree that we should be careful about how we use passkeys, but I don’t think “do not use them” is valid advice.
This article only convinces me that a company like Netflix could support passkeys in a non-restrictive form (unattested, copyable, etc) and then ratchet up restrictions slowly as adoption increases. But this is really the same game we play with all other dark patterns like price hikes, pay-to-still-watch-ads, user tracking, etc. The savvy will realize quickly that enshittification is happening, and they will seek alternatives.
To me, this is not adequate justification for boycotting the entire passkey technology. I find them convenient, and I use them in my own homelab identity provider. Only a handful of the services I use even support them properly yet, but I wish more did.
This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.
Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.
The author argues that passkey attestation would allow (eventually, via silent ratchet) any website to make demands about the software you run on your hardware. That would be a new thing and a reduction in freedom and privacy.
