1. Passkeys are viewed as a potential “trap” that could erode user control
Many commenters worry that the specification allows sites to eventually require attested, hardware‑bound passkeys that users cannot control or export.
- “What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.” – shmerl
- “The passkey issuer can demand that the passkey be hardware‑backed… Eventually it will be a particular TPM‑backed store running on an attested platform… you will only access valuable services from devices that you fundamentally have no control over.” – cvadict
- “They could start requiring this tomorrow if they wanted to… all they’re waiting for is for a significant enough portion of users to get passkeys on their platforms naturally, and then just force everyone else.” – tavavex
2. Concerns about vendor lock‑in and ecosystem control (Apple/Google/Microsoft)
The discussion frequently points out that attestation could be used to force users into specific platforms or hardware, limiting freedom.
- “Apple has made a strong case that they will not support attestation on consumer devices because they see it as a consumer privacy violation.” – WorldMaker
- “The only difference is that banks will now blame you for any losses caused by hacked devices because it is on paper ‘unhackable’… so it is now your fault that their crappy bank app’s security was broken.” – crote
- “If you want a preview of how this might all work from the technical side, just look into how TEE works for large‑scale GPU deployments right now.” – cvadict
3. Praise for passkeys’ usability and security advantages over passwords/TOTP
Several users highlight the convenience, phishing resistance, and reduced credential‑theft risk that passkeys provide.
- “With passkeys I click once and I’m in like the golden age of using the web with a password manager in 2012. It’s a huge quality‑of‑life improvement.” – qlte
- “Passkeys are unphishable. It’s technically impossible for someone else to capture your passkey and use it themselves. It’s technically impossible for your passkey to be leaked from a website.” – madeofpalk
- “Passkeys solve that. Nothing else available to the average user does [prevent stolen password reuse].” – MBCook
4. Debate over whether attestation is truly optional or will become mandatory
Commenters split on whether the attestation feature is a harmless enterprise tool or a looming threat to consumer freedom.
- “Attestation is certainly a stain on the WebAuthn spec… but this blog post is presenting a hypothetical and unlikely scenario.” – agwa
- “Attestation can only be required during credential registration; at login time it’s not possible to retroactively require attestation… Therefore, the author’s scenario … isn’t very plausible.” – agwa
- “Firefox simply warns you that the site is ‘requesting extended information about your security key … which may affect your privacy.’ It does not make it at all clear to the user that what’s really happening is that the website is gating access behind a specific approved software stack.” – nonfunctional
5. Emphasis on alternatives, fallbacks, and multi‑factor strategies
Many argue that users can retain safety by using TOTP, hardware security keys, or multiple passkeys, and can abandon passkeys if they become hostile.
- “I use TOTP or similar instead… If passkeys became some user hostile trap overnight I’d just unenroll them and use TOTP, SMS 2FA, email 2FA, or whatever else is supported.” – qlte
- “YubiKeys are a great alternative to passkeys that are just as secure if not moreso.” – nonfunctional
- “You can put your passkey in another safe… I store mine in my Vaultwarden… you can also do keepass with a plugin.” – BadBadJellyBean / MrDrMcCoy