Passkeys are promoted as a more secure and convenient replacement for passwords, but they remove ultimate user control and are deliberately confusing. The standard originates from the FIDO Alliance, a consortium dominated by corporate, government, and institutional interests with no consumer-advocacy presence. Unlike passwords or TOTP authenticator codes - both intuitive, user-controllable, and based on open standards - passkeys are a family of mutually incompatible options (copyable vs non-copyable, transferable vs non-transferable, hardware-backed vs software-backed, attested vs unattested). Those options let websites and platform vendors choose behaviors that lock users in, prevent sharing or recovery, and silently change what a “passkey” actually does. The naming conflates very different technical objects so users will not notice trade-offs when they switch.
The essential specifics: non-copyable passkeys can still be transferable; hardware-backed passkeys live inside secure chips and cannot be exported; software-backed passkeys can be files you control. WebAuthn’s many optional features give sites a “hidden dial” to restrict copying, backup, or migration, enabling gradual erosion of user autonomy (for example, preventing account rescue or forcing vendor-specific recovery). The conclusion is categorical: do not adopt passkeys if retaining control, backupability, and straightforward sharing are priorities.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Elon Musk's ownership of X has led to increased activity from prominent figures, despite his controversial actions and statements. Musk has repeatedly made offensive remarks, including antisemitic comments and deadnaming his trans daughter, which tarnish his reputation. (lexontech.org)
Ukrainian drone strikes have disabled multiple Russian Google data centers, disrupting disinformation bot traffic. The strikes are part of Ukraine's intensified efforts to target Russian digital infrastructure in response to Moscow's attacks on Kyiv. (tomshardware.com)
Dentists perform procedures based on their expertise, but their confidence can sometimes lead to unnecessary or harmful treatments, as shown in a personal account of dental interventions. The narrative highlights concerns about whether dental professionals always act in patients' best interests and the potential for over-treatment. (mapwriting.substack.com)
Homebutler is a server monitoring tool that reports only significant changes, reducing unnecessary alerts. It is a single Go binary with no database, designed for simplicity and efficiency. (github.com)
Iran threatens to cut undersea cables in the Strait of Hormuz, risking disruption to global data traffic and economic stability. The cables are vital for international communications, financial transactions, and technology operations worldwide. (theconversation.com)
The Trump administration temporarily banned Microsoft and other tech companies from sponsoring foreign workers for US permanent residency, citing abuse of immigration rules. Microsoft disputes the claim, asserting most of its US employees are American, while the ban has caused diplomatic tensions with India. (arstechnica.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.