Passkeys Face Backlash Over User Control

The essay is strongest as a sovereignty and product-design critique, though “do not use them” is too broad: passkeys can be more phishing-resistant than passwords when implemented transparently and backed by reliable recovery.

• –WebAuthn’s public-key design is sound, but synced credentials and cross-platform flows vary significantly across Apple, Google, Microsoft, browsers, and password managers. [Ars Technica](https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/)
• –“Passkey” can mean copyable, device-bound, hardware-backed, software-backed, attested, or non-attested credentials, while most user interfaces conceal those distinctions.
• –Account recovery remains the operational weak point; FIDO recommends multiple authenticators or robust re-proofing when credentials are lost. [FIDO Alliance](https://fidoalliance.org/white-paper-multiple-authenticators-for-reducing-account-recovery-needs-for-fido-enabled-consumer-accounts/)
• –Developers should make provider choice, portability, revocation, and independent backup authentication explicit before retiring passwords or other fallback methods.
• –The practical takeaway is not blanket rejection, but avoiding silent platform lock-in and treating recovery as part of the security model.