Passkeys are a trap
- ID
- 34377
- Status
- summarized
- Published
- 12 Oct 2026, 5:59 AM
- Fetched
- 12 Oct 2026, 10:48 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.0
- Created
- 12 Oct 2026, 10:48 AM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
A Substack post titled 'Passkeys are a trap. Do not use them.' argues that passkeys differ from passwords, authenticator apps and physical security keys because the relying website holds a 'hidden dial' that lets it 'gradually remove your ability to do as you please' with your credentials — though the excerpt cuts off before that technical explanation is given. It frames passkeys as a FIDO Alliance product whose members include Big Tech, banks, national governments and intelligence agencies, and notes that no consumer advocacy groups are members, unlike the W3C which includes public-interest groups and universities. Published 10 Oct 2026, the piece drew 291 points and 165 comments on Hacker News.
Why it matters
If you are shipping or planning passkey login, the useful part here is the 165-comment thread, not the argument as excerpted — the piece's central technical claim about a website-controlled 'hidden dial' is not substantiated in the text provided, so treat it as a prompt to pressure-test your own setup. Concretely: decide now which credential manager is the source of truth for your users, and write the recovery path for the case where a user's only passkey lives in one platform's credential manager and that account is lost. The FIDO Alliance membership point (no consumer advocacy groups, versus W3C's public-interest members) is the one checkable claim, and it is about governance, not about your integration.
Discussion angle
Ask everyone who has shipped passkeys to state their account-recovery flow out loud, then have someone check whether the article's 'hidden dial' claim is actually supported anywhere in the piece or only asserted — since the excerpt stops right before the explanation.