Passkeys criticised for user control limitations in FIDO Alliance standard

A recent analysis published on Substack and discussed on Hacker News raises concerns about the passkey authentication standard, arguing that it limits user control compared to other credential methods. The author, writing for a non-technical audience, suggests that while passkeys offer security benefits, their design priorities may not align with individual user interests. This perspective challenges the prevailing narrative that passkeys are an unconditionally superior replacement for passwords.

Root cause

The core issue identified is the structural difference in control between passkeys and other login credentials. According to the report, passwords allow users to decide where to store them, while authenticator apps are interchangeable and physical security keys can be handed to trusted colleagues. Passkeys, however, are described as having a hidden mechanism that allows service providers to gradually restrict user actions. This lack of ultimate user control is presented as a fundamental design flaw rather than a technical bug.

Attack path

There is no specific technical exploit or attack vector described in the source material. The argument is not based on a vulnerability that can be hacked or bypassed by an adversary. Instead, the concern is structural: the architecture of passkeys allegedly enables websites to remove user agency over time. The author likens this to a Trojan Horse, suggesting that the elegance of the system hides underlying constraints that benefit service providers and consortium members rather than the end user.

Affected versions

The critique applies to the passkey standard as currently implemented and promoted by the FIDO Alliance. The source does not specify particular software versions, operating systems, or browser releases. The argument targets the protocol itself and the governance of the FIDO Alliance, which includes Big Tech companies, national governments, intelligence agencies, banks, and institutions like Mozilla. The absence of consumer advocacy groups in this consortium is highlighted as a notable imbalance.

Mitigation

The source material does not provide technical mitigations for the passkey standard itself, as the issue is framed as a design philosophy rather than a fixable vulnerability. The author’s primary recommendation is for users to be cautious and to understand the implications of adopting passkeys. The report suggests that users should recognise that passkeys are not designed to prioritise their interests above those of the FIDO Alliance members.

What to do and how to stay safe: passkeys

• Review which services you have enrolled passkeys with and understand the recovery options provided by each vendor.
• Maintain alternative authentication methods, such as physical security keys or authenticator apps, to ensure you retain control over your accounts.
• Monitor updates from the FIDO Alliance and consumer advocacy groups regarding changes to the passkey standard or user rights.
• Evaluate whether the convenience of passkeys outweighs the potential loss of portability and control for your specific use cases.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are passkeys technically insecure?

The source states that passkeys can be far more secure than passwords, but argues they limit user control and agency.

Who controls the passkey standard?

The FIDO Alliance, a consortium including tech companies, governments, and banks, controls the standard.

Can users transfer passkeys between services?

The report suggests that unlike passwords or physical keys, passkeys have mechanisms that may restrict user freedom and portability.