The walls really are closing in though. There's basically no way we can avoid this scenario.
So we don't use passkeys? OK, fine, in 2025 that's possible. But for how long? How many sites and services are going to start requiring this? Will they care if a few HN readers are blocked out?
The only way to prevent this nightmare is to convince tech illiterate people to also avoid passkeys, but good luck! This kind of convenience is too attractive and the downsides are too hard to communicate to them.
It’s still possible to avoid this scenario. For example, imagine how conservative tech-hostile politicians would react if they understood how passkeys gives big tech authority over their money. Or when police discover that they no longer have the ability to extract passwords with a wrench. Or how parents won’t be able to access some accounts because the kid stored a passkey outside of iCloud and now it’s parent-proof. Massive outrage is due to tech over this, considering historical trends, but either no one realizes the benefits of them — or everyone doesn’t care because it’s worth not having their password stolen.
The standards body did a really excellent job solving the problem. Is outrage deserved? Is this better or worse than our freedom? I would watch that debate if someone posted a video of a panel discussing the contradictions! Because I’m not sure where I stand, either.
But I just cannot stand the obliviousness that everyone has over attestation. It’s not a done deal yet. I just haven’t seen tech suggest anything to do about it, and that continues to worry.
The key is to lie. Most tech illiterate people get their approximate knowledge from more tech literate people, who get their knowledge from the technical folk. Tech illiterate people don't know how passkeys work, if we start saying that it's just a way for scammy companies to steal your passwords, that'll eventually become truth.
So we don't use passkeys? OK, fine, in 2025 that's possible. But for how long? How many sites and services are going to start requiring this? Will they care if a few HN readers are blocked out?
The only way to prevent this nightmare is to convince tech illiterate people to also avoid passkeys, but good luck! This kind of convenience is too attractive and the downsides are too hard to communicate to them.