Passkeys Attestation Trap

Passkeys, like the Trojan Horse, appear elegant at first glance but harbor hidden dangers. Unlike passwords, authenticator apps, or physical keys, passkeys grant websites control over your authentication process. Websites can gradually diminish your options, leaving you with little choice. The FIDO Alliance's standard, now embedded in passkeys, further restricts user control.

While attested passkeys are not mandatory on most sites, their integration into the ecosystem suggests a future shift towards mandatory use. Websites, anticipating widespread adoption, may selectively disable non-attested passkeys. Remote attestation could enable websites to restrict device capabilities, potentially impacting encrypted messaging, competitor apps, and social media usage.

Apple's current passkey implementation lacks attestation support, but future changes may alter this. Synced passkeys, designed for corporate use, contradict passkeys' mass market objectives and could hinder independent credential management. Despite the author's concerns, websites have ceased requesting attestation, indicating a consensus among OS vendors, browsers, and passkey managers.

Password managers actively oppose the incorporation of attested passkeys, foreseeing their potential to exclude consumers from secure authentication options.