The Passkey Trap: Security Solution or Ecosystem Lock-in?

The tech industry is currently engaged in a coordinated campaign to convince users to abandon passwords in favor of "passkeys." As The Hack first reported, while the pitch is seductive—marketing passkeys as more convenient and more secure—the transition looks less like a security revolution and more like a strategic move to strip users of autonomy.

According to reporting from The Hack, passkeys are the creation of the FIDO Alliance. This consortium is a wide net of competing interests, including national governments, intelligence agencies, banks, public institutions, Big Tech, and "little tech," as well as the nonprofit Mozilla. While these entities agree that passkeys are a "righteous cause," their motivations are far from altruistic. The Hack suggests that Big Tech views these tools as a way to introduce "little inconveniences" to facilitate ad sales, while intelligence agencies seek global tracking and banks aim to eliminate indemnity.

Most telling is who is missing from the table. The Hack notes that while the World Wide Web Consortium (W3C)—which sets web standards—includes universities, public interest groups, and inventor Tim Berners-Lee, no consumer advocacy groups are members of the FIDO Alliance. There is effectively no one in the room advocating for the user's specific interests.

The justification for this shift is the inherent insecurity of passwords. The Hack acknowledges this point, citing examples such as the American IT company SolarWinds, whose servers were compromised via the password "solarwinds123," and Hawaii’s Emergency Management Agency, which accidentally leaked a password via a photograph of a sticky note.

However, the security problem the FIDO Alliance claims to solve has already been addressed. The Hack points to Two-Factor Authentication (via email or text) and the more robust Time-Based One-Time Passwords (TOTP), commonly known as authenticator apps. TOTP is an open standard (RFC 6238) that allows users to generate verification codes on any hardware they choose—from a laptop to a 1990s Game Boy 3—without relying on a specific vendor like Google Authenticator.

Unlike passkeys, passwords and TOTP systems allow for ultimate user control. Users can decide where to store their passwords or which software to use for their codes. Passkeys, by contrast, introduce a "hidden dial" that allows websites to gradually remove the user's ability to manage their own credentials. By framing passkeys as a necessary security upgrade, the FIDO Alliance is ushering in a system where the user no longer holds the keys to their own digital kingdom.