Comment by LCRVYSB
5 days ago
What's annoying about passkeys (and not talked about enough, including in this article) is that passkeys seem to be a boon for the targeted-advertising industrial complex.
Since passkeys are tied to verified devices, they guarantee absolute de-anonymization -- and further spread that advertising "wealth" by seamlessly linking across devices, and therefore to their respective corporate stakeholders (i.e. via bluetooth to conveniently login on a laptop via a phone-domiciled passkey).
Username + password at least requires circumstantial marketing analysis to "verify" whether a user is who marketers think they are. But with passkeys, your login confirms your Windows account ID, cell phone MAC address, home address, what have you.
AFAIK passkeys are specifically designed to avoid this. Normal passkeys contain no information about the device or software that is storing them (each key is specific to one website), and even with attestation (which I hate), the attestation reveals only what kind of device you are using (the keys are shared across many devices, usually one key per design).