Passwords suck. Can passkeys replace them?
Summary
Discusses the potential of passkeys to replace passwords as a more secure authentication method.
Similar Articles
I don't like passkeys
The article critiques passkeys, arguing that despite their security advantages against phishing, they introduce personal risks like account lockout and device loss, making them less suitable for individual users compared to corporate environments.
The passkey is worse
The author recounts a sophisticated phishing attack that spoofed Google login, Apple passkey prompts, and their Bitwarden-fork password manager—ultimately adding a new passkey to their compromised Google account—and argues passkeys and browser extension detection APIs make phishing worse.
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
This Unit 42 research discloses three novel attacks against passwordless authentication using Google's synced passkey ecosystem, showing how malware can take over passkey-protected accounts, bypass user verification, and extract private keys.
Passkeys Attestation Trap
A blog post and ensuing discussion argue that passkeys embed FIDO attestation mechanisms that could gradually let websites strip users' control over their credentials, while Apple's Ricky Mondello rebuts that attestation is explicitly not designed for mass-market consumer authentication.
Passkeys are a trap. Do not use them
一篇评论文章批评 passkeys 是一种「陷阱」，认为它们削弱了用户对自身登录凭证的控制权，并指出 FIDO Alliance 由大科技公司、政府和银行等利益方主导，缺乏消费者权益代表。