Passkeys criticised for limiting user control over credential management
An analysis argues that passkeys remove user agency by allowing service providers to restrict how credentials are stored and transferred.
Key points
- The FIDO Alliance promotes passkeys despite lacking consumer advocacy group membership.
- Unlike passwords or physical keys, passkeys allow websites to limit user control.
- The author claims this design prioritises vendor interests over user autonomy.
A recent analysis published on Substack argues that passkeys function as a trap by removing user control over login credentials. The author contends that while passkeys offer security benefits, their design allows service providers to gradually restrict how users manage access. This perspective challenges the narrative that passkeys are purely beneficial replacements for traditional passwords.
Root cause
The core issue identified is the lack of ultimate user control compared to other authentication methods. With passwords, users decide where to store credentials, and authenticator apps remain interchangeable between services. Physical security keys can be handed to trusted colleagues. Passkeys, however, include mechanisms that allow websites to limit these freedoms, effectively placing control in the hands of the service provider rather than the user.
Attack path
The vulnerability described is not a technical exploit but a structural limitation in credential management. The author suggests that the "hidden dial" within passkey implementation allows websites to remove the ability for users to act as they please. This contrasts with the transparency of other methods, where users retain explicit ownership and portability of their authentication factors without vendor-imposed restrictions.
Affected versions
The critique applies to the passkey standard as currently deployed and promoted by the FIDO Alliance. The article does not specify software versions or CVE identifiers, focusing instead on the inherent design philosophy of the technology. The FIDO Alliance includes Big Tech, governments, banks, and nonprofits like Mozilla, but notably excludes consumer advocacy groups, according to the analysis.
Mitigation
The author does not provide a technical fix for the passkey standard itself. Instead, the piece serves as a warning to users who may not fully understand the implications of adopting passkeys. The suggestion is to remain cautious and recognise that the technology may not prioritise individual user interests, despite claims of improved security and convenience by participating organisations.
What to do and how to stay safe: passkeys
- Evaluate whether your organisation requires strict user control over credential portability before adopting passkeys.
- Review current authentication policies to ensure users retain backup access methods outside of vendor-controlled systems.
- Monitor discussions regarding FIDO Alliance standards for updates on consumer advocacy involvement.
- Educate users on the differences between passkeys, passwords, and physical security keys regarding ownership.
Step-by-step guide: Password Policies Examples That Reduce Password Fatigue
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who developed the passkey standard?
The passkey standard was developed by the FIDO Alliance, a consortium including Big Tech, governments, banks, and nonprofits.
Why are consumer groups not involved?
The article notes that no consumer advocacy groups are members of the FIDO Alliance, unlike the World Wide Web Consortium.
Are passkeys less secure than passwords?
The author states that passkeys can be more secure than passwords but argues they are not designed to prioritise user interests.
