Passkeys are a trap
Points and comments are a snapshot, not live.
Passkeys offer convenience but strip user control through mandatory hardware-backed attestation.
The FIDO Alliance promotes passkeys, but unlike passwords or TOTP, they include optional features like non-copyable, hardware-backed, and attested passkeys. Remote attestation cryptographically verifies that only approved managers are used, preventing custom software. This allows services to eventually reject unattested passkeys, removing user agency. TOTP, by contrast, uses an open standard (RFC 6238) and lets users choose any software or hardware, even a Game Boy. The article warns that passkeys are a Trojan horse: initially flexible, but designed so websites can flip a switch to require locked-down, unexportable keys.
What commenters are saying
Top commenters split into two camps. One argues passkeys are fine when saved in proper password managers like Bitwarden or KeePassXC, giving users control. They counter that the article's real worry is attested passkeys, which require OS, TPM, and manager cooperation, and are already in the spec, waiting for adoption before websites mandate them. Others defend TOTP's flexibility, noting passkeys can lock users out when hardware fails or devices are unsupported. A minority propose a simpler public-key scheme, but responders note this is essentially what passkeys already are underneath the committee-driven complexity.