You’ve probably seen the notification: “Upgrade to passkeys for better security.” It sounds like a no-brainer. No more passwords. No more phishing. Just a fingerprint or a face scan, and you’re in. But here’s the truth they don’t tell you: passkeys aren’t designed to protect you. They’re designed to protect the walled gardens of Apple, Google, and Microsoft.
Passkeys weren’t built for your convenience. They were built to lock you into a system.
I first got suspicious when I tried to set one up. The process was a nightmare. I had to verify my identity with a government ID, wait for an email, then scan a QR code with my phone, then confirm on another device. It felt like renewing a driver’s license at the DMV — except the DMV doesn’t also own your email, your browser, and your operating system. This isn’t a bug; it’s a feature. The friction is intentional.
Let’s talk about device attestation. That’s the fancy term for the passkey spec’s ability to let websites demand that you only use certain passkey providers — namely, the ones from Big Tech. Imagine walking into a store and being told you can only pay with a credit card issued by that store’s parent company. That’s what passkeys do. They turn your identity into a tool for vendor lock-in.
Device attestation is the digital equivalent of showing your ID to enter a store — except the store decides which IDs are valid.
And the people who built this? They’re engineers who have never had to explain to their grandmother how to log in. The average user doesn’t understand SSH keys, and passkeys are just SSH keys with a prettier wrapper. We’ve been doing this since the 90s, and it never caught on outside of Linux sysadmins — because it’s a pain. Now they’re trying to force it on everyone, and they’re framing resistance as being “behind the times.”
One commenter on a viral thread put it bluntly: “Passkeys are a vector for locking your logins to Big Tech ecosystems.” Another pointed out that the passkey spec authors also maintain a list of approved clients — guess who’s on that list? Apple, Google, Microsoft. Surprise, surprise.
But here’s the kicker: the security argument is a red herring. Yes, passkeys are more resistant to phishing than passwords. But the real threat isn’t hackers — it’s the concentration of power. When your entire digital identity is tied to one ecosystem, a single account suspension or a ban means you lose access to everything. Passkeys don’t give you security; they give you a landlord.
The biggest threat to your digital freedom isn’t hackers — it’s the ‘solution’ they’re selling you.
So what should you do? For now, avoid passkeys where possible. Stick with password managers and hardware tokens that you control. When a service forces you to use a passkey, ask yourself: whose interest does this serve? If the answer isn’t yours, push back.
Because the next time you’re prompted to “upgrade” your login, remember: the DMV doesn’t have your best interests at heart. And neither does Big Tech.
FAQ
Q: Are passkeys actually more secure than passwords?
A: Technically yes — they resist phishing and credential theft. But the security gain is marginal for most users, while the lock-in and usability costs are huge. The real risk is concentration of power, not hacked accounts.
Q: What should I use instead of passkeys?
A: A good password manager with unique, strong passwords, plus hardware-based 2FA (like a YubiKey) that you control. That gives you better security without handing your identity to a single Big Tech company.
Q: Isn't device attestation a good thing? It prevents fake passkeys.
A: It prevents fake passkeys, but it also prevents legitimate independent passkey providers. It’s a cudgel for ecosystem control dressed up as a security feature. The spec should allow any compliant client, not just the ones on an approved list.