I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.
Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
A recent 1password update borked something with passkeys. They didn’t work at all for me for a week.
I have to log in to some things daily with passkeys, so it was really annoying.
Might be worth trying again, because they now work reliably for me again.
This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.
Thanks for the helpful info
This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.
Can’t remember when a piece of paper I have in my purse failed to tell me an important password.
I have passkeys in many sites, but they are never the only sign in option. Username + pass + TOTP keep working as an alternative.
That wasn’t my experience but maybe 1pass defaults to only keeping one kind of credential per site?
Maybe. Do passwords vanish after you set up a passkey? I thought you were saying the server refused to sign you in, but it’s a bit sketchy if your password manager just chooses to replace secrets behind your back. Especially being different categories (password and passkey).
I set up a passkey and stored in 1pass, it worked for that 1st attempt. Time passes, I don’t recall if I’ve gone back to the site in the interim. I go to the site again and it errors on my passkey and I can no longer use my password. Thinking about it some more, I think my original password wasn’t deleted from 1pass so I my guess about 1pass being at fault isn’t right. But it’s possible that websites test for storing in iOS, Chrome and whatever the Android default is and anything else working is just luck.
Seriously was the author paid by the word? Also even though I believe their main point is valid, they employ more than one Straw Man argument in conveying their reasoning. Nevertheless I have been opting out of passkeys since I first saw them for the simple reason that I was being told by sites and apps that I should use them - and I know that no company ever advises you to do something that’s in your own best interest. Therefore I didn’t trust by default. lol.
Y use lot word? Few good
Damn yesindeed!
Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
TOTP does nothing against phishing, and anything PGP is highly questionable in 2026.
But, I agree about the FIDO U2F keys.
why is PGP questionable ?
No infrastructure of it’s own to support it.
anything PGP is highly questionable in 2026.
PGP has nuisance usability, but I do have control over my keys.
What’s the standard used by YubiKey most of the time to save authentication methods? Right, it’s PassKey
Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
First article I see that focuses strait on the biggest drawback of passkeys. Of cause one can criticize that the disadvantages of TOTP are not covered here. That does not make the argument invalid though.
