6 ms·

What's the concern with using passkeys?

• moebrowne 4mo ago
  Not the OP, but I'd assume they are talking about 'direct' attestation mode creating vendor lock-in
  • Scott_Helme_ 4mo ago
    I can kind of see it, but you can also just use an authenticator from any manufacturer, or have multiple types that you use? I'm just curious what I'm overlooking.
    • moebrowne 4mo ago
      > I've encountered multiple sites that now use authenticatorAttachment options to force you to use a platform bound Passkey. In other words, they force you into Microsoft, Google or Apple. No password manager, no security key, no choices. https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-still-have-problems/ https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-sti... and more discussion here: https://news.ycombinator.com/item?id=46301585 https://news.ycombinator.com/item?id=46301585
      • Scott_Helme_ 4mo ago
        Interesting, could you link me to some of those sites so I can investigate?