Hacker News: nonfunctional

New comment by nonfunctional in "Passkeys are not a trap"

nonfunctional — Wed, 14 Oct 2026 17:36:01 +0000

I put a reply to this article in the comment section of "Passkeys are a trap. Do not use them."

https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-...

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Mon, 12 Oct 2026 02:31:47 +0000

Note that YubiKeys are not passkeys. But they are a great alternative to passkeys that are just as secure if not moreso.

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Mon, 12 Oct 2026 02:30:36 +0000

Be that as it may, they can still roll out the passkey attestation requirement gradually, -- "flip the switch" just a few thousand users at a time -- so that at no one point in time is there a large blip in users. Truth be told, tech platforms don't even really need to measure what portion of users' devices support remote attestation, since the overwhelming majority of devices will support it. They just need to know that users are passkey-capable in the first place; once enough users have passkeys in any form, they can start requiring remote attestation.

As for the browser permission prompt: Firefox simply warns you that the site is "requesting extended information about your security key [sic] which may affect your privacy." [1] It does not make it at all clear to the user that what's really happening is that the website is gating acces behind a specific approved software stack. If I use a non-widely-used OS or device, what website is going to approve its attestation credentials?

[1] https://github.com/mozilla-firefox/firefox/blob/8e9ac3e12bba...

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Sun, 11 Oct 2026 23:05:59 +0000

You're right, I didn't explain in much detail the motivation that will push websites to start requiring the remote attestation flag to be set. I will try to cover that in a future article.

But as for how it could "catch" you: if you use FOSS devices that are unattestable (as is the case for the LineageOS phone and Linux laptop I exclusively use), you may one day find you can't use many websites.

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Sun, 11 Oct 2026 22:59:28 +0000

If you also support TOTP and physical security keys as an alternative to passkeys, that should be enough to provide a stable long-term alternative for users of FOSS devices. And of course, RP-side you can choose to never require the remote attestation flag to be set.

Convenience is precisely the thing that big tech established tech platforms want to reward their users with to keep them around. The undeniable convenience of passkeys didn't have to come with a standard that is threatening against unattestable devices like my Linux phone. But it does, and that means passkeys are a way that the industry can discourage people away from using non-Google/Apple/Microsoft-approved devices.

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Sun, 11 Oct 2026 22:49:54 +0000

The intended audience is people who are not yet using passkeys, or have just started (due to all the websites demanding them now) but don't really know what they are.

I apologize that the headline is provocative. I thought for a long time about how to appeal to both people who are barely aware of what passkeys are but also not put off people who like them. I considered calling them a "Trojan Horse" in the headline as I do in the body (i.e. legitimately lovely, but with a terrible and unobvious problem) but "trojan" has another connotation in computer security.

Nonetheless, I said what I meant. Convenience is how they get you. This convenience didn't have to come with a trap, but thanks to the way it was designed, it does.

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Sun, 11 Oct 2026 22:41:08 +0000

My understanding is that TOTP and physical security keys both share very little information about you. Perhaps passkeys, being part of a standard that the FIDO Alliance keeps updating, may some day be expected to reveal considerably more information. And the limited number of remote-attestation-approved passkey managers might someday all start start volunteering such information regardless.

New comment by nonfunctional in "Passkeys are a trap"

nonfunctional — Sun, 11 Oct 2026 22:35:52 +0000

I completely agree that KeePassXC and other password managers give you total user control, and they do support "passkeys" -- but crucially, not all kinds of passkeys. KeePassXC has no remote attestation support, nor hardware-backing support, and nor do I think it should.

My claim is not that passkeys couldn't give you control in principle. It's that the standard readily allows for websites to prevent you from being allowed to exercise that control, and the unclear messaging and UX around passkeys means most users will not even notice should this happen.