Comment by jchw

7 days ago

I am very hopeful that passkeys will fail overall. They've definitely forced a lot of adoption quickly, but I think also that a lot of people have no idea what they've signed up for, and there is a decent chance of a quiet, slow retraction in the long run. Their death will be well-earned by just the attestation alone - one hundred percent, in my opinion. I tell my loved ones to not use passkeys simply because they're much more likely to accidentally run into scenarios where they lose the device. I'm not going to stop. I encourage everyone to do the same.

I still am using passkeys for some sites because they otherwise force you into insecure processes like SMS-based 2FA with implied humiliation rituals, but banks are the worst offenders and they seem to like discriminating against open source password managers, so while they are not using attestation I am still patching my password manager to lie about its identity. Hopefully this will become more common in the future.