Passkeys Are Not a Trap

Commenters argued intensely about passkeys versus existing password/TOTP habits. Many users (bonzog, hbn, sdcfgy, rietta) described passkeys as confusing and fragile: they worry about inconsistent storage across platforms (Google, Samsung, iCloud, Windows), cross-device sign-in failures, QR/Bluetooth flakiness and enterprise restrictions, and simple loss of access when changing devices. dllu gave concrete examples of failed logins via Firefox, managed Chrome, VNC and services that refuse passkey use, and YakBizzarro noted real-world whitelisting that already excludes some managers. Several people said their current approach - random passwords in a password manager or KeepPassXC plus multiple YubiKeys (jgrahamc, PaulHoule) - feels more reliable and recoverable.

Other commenters debated the security-policy angle. coaksford and _bent warned the real fear is attestation being tightened into device/OS whitelisting rather than attestation itself, while NoidFonsense and jerf said attestation could be expanded and used coercively by banks or vendors. Vexs and tennysont countered that attestation’s information content and current practice limit such control and that hardware keys (YubiKey) can mitigate risks, though tennysont noted some devices already leak verified boot state. freakynit accused the article’s author of commercial incentives to promote passkeys. In short, opinion split between those who see passkeys as manageable with hardware mitigations and those who see real usability and vendor-lock risks that make them a trap.