Passkeys seem to be advertised in ways that puts people off:
-
TPMs, Secure Enclaves, etc. are deeply closed-source and security by obscurity. Until there is an open TPM implementation available, many users may prefer not to rely on them. It seems like KeepassXC allows circumventing TPM for Passkeys, but most people probably don’t know that.
-
Too much “trust me bro, my cloud is safe” advertising from big Passkey advocates like Google.
-
A classic hardware key may be indistinguishable from a normal password being entered. But Google has announced they want to push passkeys against user’s wishes here: “Is opting-into passkey mandatory? No, […]. However, over time, as users become more accustomed to passkeys, we might limit where we allow passwords to be used because they’re less secure than passkeys.” Again, not a great look.
-
Collecting biometric data is always dangerous. I’m aware that Passkeys can be used without that, but many people may be put off before they realize that.
I think that’s why Passkeys have poor adoption among privacy advocates, even though most problems seem fixable.
I wasn’t arguing against Passkeys, just pointing out how they are often perceived.
I was definitely arguing against TPMs, however. https://gist.github.com/osy/45e612345376a65c56d0678834535166 https://pluralistic.net/2024/01/18/descartes-delenda-est/#self-destruct-sequence-initiated https://www.elevenforum.com/t/tpm-2-0-is-a-must-they-said-it-will-improve-windows-security-they-said.13222/ https://scispace.com/pdf/tpm-2-0-uefi-and-their-impact-on-security-and-users-freedom-2e1ldhodqq.pdf https://www.gnu.org/philosophy/can-you-trust.en.html (But Passkeys apparently don’t need them, see my KeepassXC mention before. Should avoid biometric data, too.)