Opinion: Passkeys Give Users Less Control Than They Appear To
A technology commentator argues in an essay that passkeys, which are replacing passwords, give users less control than passwords or authenticator apps. He also criticizes the make-up of the FIDO Alliance, which has no consumer advocacy groups among its members.
Internet users are increasingly being asked to move from passwords to passkeys. In an essay published on Substack, the author argues that the technology is more secure than passwords and can be more convenient, but does not give users full control over their own login credentials. The piece is the author's opinion, not an independent study.
Who is behind passkeys
Passkeys were developed by the FIDO Alliance, a consortium that includes large tech companies, smaller firms, national governments, intelligence agencies, banks, public institutions and a few nonprofits such as Mozilla. The author points out that no consumer advocacy group is a member. By comparison, he cites the World Wide Web Consortium (W3C), which sets web standards and includes public interest groups, universities and Tim Berners-Lee, the inventor of the World Wide Web.
Passwords and TOTP
The author agrees that passwords are insecure, citing the password "solarwinds123" found on servers of the IT company SolarWinds, and a password at Hawaii's Emergency Management Agency that was visible on a sticky note in a photograph. However, he says the security problem has already been solved by two-factor authentication and time-based one-time passwords (TOTP, known as authenticator apps). TOTP generates a new number every 30 seconds from the current time and a key unique to the user. It rests on an open standard, RFC 6238, so no specific app such as Google Authenticator is required. Users decide where to store the data and whom to share it with.
The passkey "trap"
Passkeys are built on the open WebAuthn standard, and the author first shows that one can be created with open-source software and emailed to a friend. But he argues the FIDO Alliance uses the single word "passkey" for several different kinds of credential: copyable or non-copyable, transferable or non-transferable, stored as a file or in a secure chip (such as a Trusted Platform Module or the iPhone's Secure Enclave). In his view this confuses users, and he urges them to know exactly what kind of passkey they are creating. The source excerpt ends before the full argument is made.
