I wanted to be sympathetic to the author. Passkeys are complicated, especially since they now try to cover so many situations, and it certainly originates from the corporate world. But this guy is spreading FUD. Tim Cappalli pointing out security shortcomings in keepassxc's implementation a couple of times is not proof that FIDO Alliance is anti open source.
this post was submitted on 01 Sep 2025
22 points (77.5% liked)
Pulse of Truth
1565 readers
32 users here now
Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).
This community is automagically fed by an instance of Dittybopper.
founded 2 years ago
MODERATORS
The spec has issues due to usual RFC bullshit and corporate greed, but as per usual the viewpoint here is too narrow. I'm running my own open source authentication stack and choose what attestations are acceptable, say only allow the FIPS version of Yubikeys. That feature exists because companies want to be able to control which methods they consider secure enough for their own employees. This tech was built for corporate security, using it externally facing with end-users is a bolted on after the fact idea. Having control is necessary, it does not make the spec evil.
Now say GitHub enable attestations that only allow Windows Hello passkeys to go through, then yes that's technically possible. It would also be a support nightmare so they won't. (It's already a support nightmare for anyone limiting devices since for example security key vendors regularly forget to publish their fingerprints for new products.)
The whole biometrics thing? Total red herring. UV can be enabled in many different ways and totally "faked" as well, which is what all the software implementations do such as Bitwarden. Only way to stop it is approvelisting specific devices, see point above.
A passkey is a FIDO authentication credential that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern).
… What? Stop. What are you talking about? My Linux desktop doesn’t even have a lock screen. Are you going to somehow notice my screensaver exiting to permit a login? How can that possibly work? Are they trying to tell me that their fancy new login system only works on certain proprietary operating systems? Really?
Article is bullshit, dude thinks potential use cases are mandatory features. That's mental
Very important message. I always had the feeling that passkeys were a corporate scam but this confirms those suspicions.
Doesn't the post conclude the opposite however, that you can in fact manage your own passkeys outside of any "big tech"?
I think one important detail the author missed is that passkeys are in most cases not a sensible replacement for a password. They can act as a convenient semi-permanent replacement or second factor, but you will always need a mechanism should the passkey, or device be lost, which will be a traditional password or account recovery.
If parties do not trust your particular passkey provider / system then you lose that convenience, but the spec does need someway to handle obviously flawed or broken client implementations. If all your passkeys are hanging out in plain text without a pin/biometric/other key gating their access, they are all compromised and should be rejected.
Doesn’t the post conclude the opposite however, that you can in fact manage your own passkeys outside of any “big tech”?
I dont know how you missed the whole first section... If the provider can force you into device/software attestation then that indeed means that you can NOT use your own passkey management system without having to worry about being locked out.
If all your passkeys are hanging out in plain text without a pin/biometric/other key gating their access, they are all compromised and should be rejected.
No thats actually not an issue at all if your device is secure and uses full disk encryption. And if your device isnt secure then any additional security measures like password managers are ineffective anyways. If i want to write down my private key on a piece of paper and type it in by hand then thats my issue to deal with and not theirs.
Software passkeys can't provide attestation and don't. A service requiring it would reject every apple and google device too. Its a feature for hardware like yubikeys and smart cards used by governments to ensure it's not a knockoff with backdoors.
No thats actually not an issue at all if your device is secure and uses full disk encryption.
Oh I see your computer is secure well then nothing to worry about 🤣
If i want to write down my private key on a piece of paper and type it in by hand then thats my issue to deal with and not theirs.
With a hardware FIDO2 key, the private key never leaves the device, instead it signs challenges. Malware on the PC can't access the private key and make it's own copy.
Using software keys, they are at least encrypted in the vault until you open it, then there'll be a window of time with a plain copy in memory that malware can potentially grab.
Your plaintext private key file can be stolen by malware easily and immediately. You would actually be better off with it written on a post it note.
Course in real life malware is gonna be stealing your browser cookies to gain access to your accounts and avoid the whole keypass thing. In the world that FIDO was born, authentication is happening all the time and any possibility of key theft is considered a compromise.
The problems highlighted in the first section are optional however. Forcing a particular authentication / device attestation method isn't a passkey problem, it's a provider problem. They are free to do that today with or without passkeys. Equating passkeys = bad because of that feels harsh; it is like any scenario where bad actors behave badly with any given technology.
Passkeys give them an excuse to block devices 'for security reasons '