Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn't Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).

But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator...

We've been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for "security"?

It seems perfectly in line, and I think this article draws all the right parallels.

finally people are waking up to this garbage.

Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they

• force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
• add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That's not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
• take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
• deny me anonymity and control over my accounts. I can have only one account per domain.
• are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.

The recommendation “do not use them” is cute. They are forced on people. I can't choose.

So... Uh... What's a passkey? The article is saying they're pure evil. Everyone here is saying they're good. Everyone knows what they are except for me.

What's the difference between a passkey and a password?

Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:

Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.

I don't see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.

Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn't make them "traps".

The article warns that passkeys could be used, assuming they become the only form of logging into platforms, to prevent someone using the wrong operating system to log into those platforms.

Being prevented from using certain applications because you use the wrong OS is nothing new, but there is, from everything i have seen, always a reason to block it, they dont do it for someone elses benefit. A lot of banking apps cannot be used on many android roms; without microg or gapps many android apps wont work (some wont work even with microg); games sometimes use kernel-level anticheat that forces players to use windows; people solved this issue by just not using those apps

Why would a significant portion of used websites/applications that require accounts stop allowing passwords or authenticator apps, relying on this open standard, force certain options to be used for the standard and ensure that the user isnt on an operating system they have no reason to care about. There are already methods to prevent people from using a certain OS, they could just not rely on an open standard

Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.

When something wants too much power, you must avoid.