Post #1579199

2026-03-01 04:49 UTC

Passkeys seem to be advertised in ways that puts people off (edit: not saying that makes them bad): - TPMs, Secure Enclaves, etc. are deeply closed-source and security by obscurity. Until there is an open TPM implementation available, many users may prefer not to rely on them. It seems like [KeepassXC allows circumventing TPM for Passkeys](https://discuss.privacyguides.net/t/keepassxc-added-passkeys-support/17288/8), but most people probably don't know that. - Too much "trust me bro, my cloud is safe" advertising from big Passkey advocates like Google to try to get people to use their invasive services. - A classic hardware key may be indistinguishable from a normal password being entered. But Google has announced they want to push passkeys against user's wishes [here](https://safety.google/safety/authentication/passkey/): "Is opting-into passkey mandatory? No, [...]. However, over time, as users become more accustomed to passkeys, we might limit where we allow passwords to be used because they’re less secure than passkeys." Again, not a great look. - Collecting biometric data is always dangerous, too many attack vectors during processing. I'm aware that Passkeys can be used without that, but many people may be put off by that push. I think that's why Passkeys have poor adoption among privacy advocates, even though most problems seem fixable. > Caring about privacy and caring about the details of a security protocol are distinct. You’d be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunat

Replies (1)

@ricecake@sh.itjust.works 2026-03-01 06:14

I'm not seeing anything that's not a great look about requiring strong authentication for access to sensitive portions of a users account. What you're saying is akin to calling it a bad look that they force users to use complex passwords against user wishes. I'm not sure what "trust me bro, my cloud is safe" has to do with anything. Passkeys live on your device. There are ways of facilitating device to device migrations of the keys if you want. You don't need to use them to use passkeys. And at least on Android you don't need to even use Google to manage the keys. Most semiconductors are closed source. The processor, ram, and radio are also more than likely closed. The software interfaces to all of them have open specification and implementation. There's like, six for Linux. Microsoft open sourced theirs. Tpms are not security through obscurity. They are obscure, but that's not a critical component to their security model. What they do isn't really what "collecting biometrics" implies. They're storing key points in a hashed fashion that allows similarities to be compared. Even if it wasn't encrypted in a non-exportable way you still can't do anything with it beyond checking for a similarity score. You've done a good job explaining what I said previously: there's sometimes a disjoint between privacy and security concern, and so sometimes people don't understand something about security.

Open ##1579200