The only part that is relevant re: trap is about a specific kind of passkey that is restricted to certain hardware, meaning if you have to authorize with it you are giving up control on how it can be used over to that hardware. Like a TPM chip or one of those USB keys.
It’s true that having that required could be a slippery slope, like requiring biometrics. Though even then current standards don’t pass biometric data out of the security chip.
At the same time there are companies and governments that have required similar things since before passkeys were common. They were just more expensive and less standard. They are just different levels of proving identity. The risk or absurdity is in the level of identity they could ask you to provide, the hoops you have to jump through, and the slippery slope of what more they could keep trying to ask for. But I really think that’s independent of this technology, it’s just a vehicle for the author to raise concerns about it and in that case their focus is on the wrong thing.
They should be focused on banning PII collection. Passkeys are actually an enabling technology for privacy and anonymity in nearly all of their iterations. They are basically a combo of username and password that can be put in a secure vault, so you can in theory just rely on having a few registered at a website and never need an email, phone number, etc. Your login is any registered passkey. Your recovery method is to use any of the backup keys you registered. But consider the current status quo of websites where you pay for something. You have to provide email, name, phone number, and billing info. You are fully personally identified. Passkeys provide much less information than that.
The only part that is relevant re: trap is about a specific kind of passkey that is restricted to certain hardware, meaning if you have to authorize with it you are giving up control on how it can be used over to that hardware. Like a TPM chip or one of those USB keys.
It’s true that having that required could be a slippery slope, like requiring biometrics. Though even then current standards don’t pass biometric data out of the security chip.
At the same time there are companies and governments that have required similar things since before passkeys were common. They were just more expensive and less standard. They are just different levels of proving identity. The risk or absurdity is in the level of identity they could ask you to provide, the hoops you have to jump through, and the slippery slope of what more they could keep trying to ask for. But I really think that’s independent of this technology, it’s just a vehicle for the author to raise concerns about it and in that case their focus is on the wrong thing.
They should be focused on banning PII collection. Passkeys are actually an enabling technology for privacy and anonymity in nearly all of their iterations. They are basically a combo of username and password that can be put in a secure vault, so you can in theory just rely on having a few registered at a website and never need an email, phone number, etc. Your login is any registered passkey. Your recovery method is to use any of the backup keys you registered. But consider the current status quo of websites where you pay for something. You have to provide email, name, phone number, and billing info. You are fully personally identified. Passkeys provide much less information than that.
Fat chance.