What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.
You only have as much control over any login credential as the provider gives you. At the end of the day, if you have a password or TOTP seed registered with me, I can revoke the binding for any reason and make you re-register. Writing it down somewhere or sharing it with somebody doesn’t matter if it’s not bound to your account anymore.
If you won’t trust a service provider with a passkey, I’m hard pressed to think why you’d trust that service provider with anything.
The problem is not passkeys in themselves, but the role they might play in making remote attestation ubiquitous. Remote attestation locks in an oligopoly from hardware through operating system, and the operating system vendor can apply any restrictions they want. Remote attestation is already a problem for users of aftermarket operating systems on phones, but not a ubiquitous one because it mostly only affects payment and some banking apps.
Every time passkeys come up, I am roundly assured that attested passkeys are DOA, because starting to require them would force Apple to revoke all of its existing passkeys. But I don’t have confidence that that’s a sufficient deterrent.
Specifically the conspiracy theory that passkeys are some kind of backdoor is strange to me:
For intelligence agencies, and for corporations like Microsoft, Google, Apple, Facebook, Amazon – giving you convenience and security is likely not their primary goal. I think they have an entirely ulterior motive. They can use passkeys to prevent you from running unapproved software.
And:
I’m not one to argue about slippery slopes, so I won’t claim that the campaigns to protect children online today will tomorrow turn into laws designed to make it easy to identify political dissidents. But I will say that the widespread adoption of the passkey technology being advertised to you as convenient and secure is capable of permitting such laws to be easily enforced.
The ulterior motives are really around cost of managing credentials and having better assurance that a user is who they claim to be. Instead of paying to have a help desk or a password reset service they can offset the cost to you to have the necessary computing modules or hardware keys to authenticate. Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse. And there are better and more effective means to achieve the other ends the author is worried about, like having a monopoly on 96% of web browsers or killing the market for PCs.
Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse.
These are literally the same thing. Digital ID is a policy, passkeys are a mechanism. By combining them, you implement a digital ID policy. I grant you that the implementation of a digital ID policy doesn’t necessarily need to use this technology, nor does this technology lack other useful purposes, but we live under the regime of technological capitalism, where innovation is driven purely in the pursuit of maximizing profit and consolidating power.
The author is fully justified in being suspicious of the motivations of such an infamous coalition including the likes of Apple, Google, Microsoft, Meta, American Express, MasterCard, Bank of America, Wells Fargo, JP Morgan Chase, HSBC, Softbank, Binance, and Coinbase, among others. This is a substantial confluence of Wall Street finance, Silicon Valley venture capital, and every tech company large and small who is lined up to sell shovels in the gold rush of a pending transformation of digital power relations. The threat should be taken seriously, at least.
None of these firms are concerned with our best interests. By now we should assume any implementation which leaves room to further encroach on individual autonomy is a deliberate strategy.
You only have as much control over any login credential as the provider gives you. At the end of the day, if you have a password or TOTP seed registered with me, I can revoke the binding for any reason and make you re-register. Writing it down somewhere or sharing it with somebody doesn’t matter if it’s not bound to your account anymore.
If you won’t trust a service provider with a passkey, I’m hard pressed to think why you’d trust that service provider with anything.
The conspiratorial angle is also kinda strange: https://commission.europa.eu/topics/digital-economy-and-society/european-digital-identity_en A digital ID with identifiable PII that the surveillance capital state can abuse via central management and is associated with every transaction is the desired end-state for capital and other wielders of power.
The problem is not passkeys in themselves, but the role they might play in making remote attestation ubiquitous. Remote attestation locks in an oligopoly from hardware through operating system, and the operating system vendor can apply any restrictions they want. Remote attestation is already a problem for users of aftermarket operating systems on phones, but not a ubiquitous one because it mostly only affects payment and some banking apps.
Every time passkeys come up, I am roundly assured that attested passkeys are DOA, because starting to require them would force Apple to revoke all of its existing passkeys. But I don’t have confidence that that’s a sufficient deterrent.
What now? Is it strange or is it entirely expected?
Specifically the conspiracy theory that passkeys are some kind of backdoor is strange to me:
And:
The ulterior motives are really around cost of managing credentials and having better assurance that a user is who they claim to be. Instead of paying to have a help desk or a password reset service they can offset the cost to you to have the necessary computing modules or hardware keys to authenticate. Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse. And there are better and more effective means to achieve the other ends the author is worried about, like having a monopoly on 96% of web browsers or killing the market for PCs.
These are literally the same thing. Digital ID is a policy, passkeys are a mechanism. By combining them, you implement a digital ID policy. I grant you that the implementation of a digital ID policy doesn’t necessarily need to use this technology, nor does this technology lack other useful purposes, but we live under the regime of technological capitalism, where innovation is driven purely in the pursuit of maximizing profit and consolidating power.
The author is fully justified in being suspicious of the motivations of such an infamous coalition including the likes of Apple, Google, Microsoft, Meta, American Express, MasterCard, Bank of America, Wells Fargo, JP Morgan Chase, HSBC, Softbank, Binance, and Coinbase, among others. This is a substantial confluence of Wall Street finance, Silicon Valley venture capital, and every tech company large and small who is lined up to sell shovels in the gold rush of a pending transformation of digital power relations. The threat should be taken seriously, at least.
None of these firms are concerned with our best interests. By now we should assume any implementation which leaves room to further encroach on individual autonomy is a deliberate strategy.