Comment by growse
7 days ago
I disagree. TFA is extremely muddled in it's thinking, and the appeal to conspiracy is rather distracting from any good points that might exist.
Hence my question about "why though?". The only answer I can see is "user control", but I have no idea what that is. It sounds like a means, but to what end?
If we peel back from the conspiracy theory, it's because account take overs (ATO) by hackers cost companies money. Customer support, lost data, money stolen, fines, etc. So companies don't want people to get hacked. But they know people are lazy and just want to use 12345 as their password. So passkeys are a way to have the user's password be something really good (xkcd 936) and unstealable, assuming no bugs in the software (haha). So it will be harder for users to get hacked, lowering their costs. That passkeys come with some limitations, like oh by the way, now you're stuck paying Apple/Google/1password a subscription fee for the rest of your life, is merely a happy side effect for the corporation.
Thank you for articulating.
> That passkeys come with some limitations, like oh by the way, now you're stuck paying Apple/Google/1password a subscription fee for the rest of your life, is merely a happy side effect for the corporation.
I see this, but I disagree with the conclusion for two reasons.
1) there's no evidence of this happening in the consumer passkey space despite enormous opportunity.
2) we already have instances of lock-in to services by service providers. Whether it's banks demanding you use their little weird dongle to login, or apple demanding you use an iDevice to use airtags or parental controls. This is, I agree, a problem. But the market seems to be working it out quite well