Passkeys are promoted as a modern replacement for passwords, marketed as more secure and convenient. The FIDO Alliance—a consortium of Big Tech, government agencies, banks, and other institutions—drives this push, yet it notably excludes consumer advocacy groups that would represent end‑user interests, unlike the World Wide Web Consortium which includes public interest representatives alongside corporate members.
Unlike passwords or authenticator apps where users retain ultimate control—choosing where to write them down, selecting which app to use, or sharing physical security keys—passkeys incorporate what the author describes as a “hidden dial” that websites can use to gradually restrict how users employ their credentials. The standard actually encompasses multiple variants: copyable vs. non‑copyable, transferable vs. non‑transferable, hardware‑backed vs. software‑backed, user‑present vs. non‑user‑present, and user‑verified vs. non‑user‑verified. The FIDO Alliance applies the single term “passkey” to all these distinct implementations, creating confusion that discourages close examination of the fine print.
Because users cannot discern which specific type of credential they are using, they lose the ability to back up, share, or move their passkeys freely. Websites may later change their requirements (e.g., demanding attested or hardware‑bound variants) without user consent, effectively removing access that users previously had. This shift serves institutional goals such as reducing liability or enhancing surveillance, leaving individuals dependent on providers whose priorities may not align with personal autonomy.