“Passkeys are a fantastic technology…but a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss.”

hawksley.dev blog post · Sep 17 · Developer criticizes passkeys as poor fit for personal security

“By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.”

hawksley.dev blog post · Sep 17 · Developer criticizes passkeys as poor fit for personal security

“Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account's security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.”

hawksley.dev blog post · Sep 17 · Developer criticizes passkeys as poor fit for personal security

“If their automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too.”

hawksley.dev blog post · Sep 17 · Developer criticizes passkeys as poor fit for personal security

“Hardware keys support discoverable credentials…yet have limits of 25-100 accounts per hardware key, and top of the line keys can have up to 300.”

hawksley.dev blog post · Sep 17 · Developer criticizes passkeys as poor fit for personal security