Ricky Mondello responds to "Passkeys are a trap. Do not use them."

Commenters argued over whether Ricky Mondello’s rebuttal to “Passkeys are a trap” actually answers the criticisms. rstuart4133 and dmitrygr said the rebuttal fails to address a core concern: some applications need cryptographic proof that keys are kept secure and current attestation mechanisms either aren’t present or force vendor lock‑in. JamesLeonis expressed broader distrust of large vendors and standards bodies, arguing passkeys risk becoming another way companies steer users toward proprietary implementations, while lxgr defended Mondello as rightly calling out poor reasoning in the original post. latexr highlighted Mondello’s role at Apple to explain why his views matter.

The discussion pivoted to a KeepassX/KeepassXC PR and alleged industry pressure: FireBeyond and others described warnings that tools enabling passkey export might be “blocked” by relying parties, while jesseendahl disputed some factual claims, saying only Apple supported passkey sharing and pointing to the Credential Exchange Protocol (CXP/CXF) work and a closed PR favoring that standard. FireBeyond pushed back about practical differences between sharing and exporting and quoted a warning that sounded like an implicit threat. Commenters split between fearing vendor-driven lock‑in and opaque enforcement, and defending movement toward standardized credential exchange and vendor assurances as solvable engineering problems.