Seems like every website wants us to stop using passwords. There is a replacement we are being asked to use instead called passkeys. This should be a tad concerning if passwords are familiar to you and you don’t fully understand these nebulous passkeys.
Websites say that passkeys are more secure or more convenient or something similarly beneficial. While it is true that passkeys can be far more secure than passwords, and may indeed be more convenient, that’s not the whole story. Passkeys are not designed to prioritize your interests. Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.
The part worth arguing about isn’t the crypto, it’s the sync.
Passkeys are just WebAuthn/FIDO2 credentials (W3C WebAuthn Level 3). The private key stays in the authenticator and is bound to the site’s origin, so a lookalike login page has nothing to steal. That isn’t marketing, it’s the design, and it’s why they beat passwords and SMS codes at phishing.
Where the “trap” framing does have teeth: the default consumer passkey is a syncable authenticator, copied into Apple’s, Google’s or Microsoft’s keychain (or a password manager) so it works on a new phone. NIST SP 800-63B-4 is blunt about that: syncable authenticators are inherently exportable and SHALL NOT be used at AAL3, only AAL2. So “more secure than a password” is solidly true for a hardware token and only conditionally true for the synced one in your pocket.
The lock-in complaint is the strongest point, and also the one aging fastest. Portability used to be the hole. FIDO has since published Credential Exchange Specifications, and Dashlane (Android) plus Bitwarden (iOS 26) are shipping it. Moving a passkey between providers is being built, not impossible forever.
The honest trade is recovery. With a password you hold the backup. With a synced passkey the backup lives in a platform account, so the attack moves from “guess your secret” to “take over the account that holds it.”
Open question for the thread: past sync custody, what’s the concrete attack? I can’t name a way an origin-bound passkey gets phished or silently forced on you. If someone can, that’s the actual story.