Report warns passkeys strip user sovereignty, posing operational risks to organizations

A recent report circulated on Hacker News argues that passkeys function as a trap by removing user control over login credentials. The article, which garnered significant attention, suggests that the FIDO Alliance’s standard prioritizes vendor interests over user sovereignty. This critique touches on the operational risks for organizations adopting passkeys as a primary authentication method.

What are passkeys?

Passkeys are a credential format promoted by the FIDO Alliance as a more secure and convenient alternative to traditional passwords. The alliance consists of competing interests including Big Tech companies, national governments, intelligence agencies, banks, and nonprofits like Mozilla. These members agree that passkeys represent a beneficial advancement for web security, despite having divergent underlying motivations.

Why is user control a concern?

The report claims that unlike passwords or authenticator apps, passkeys do not give users ultimate control. With passwords, users can choose how to store them; with physical security keys, they can share access with trusted colleagues. Passkeys reportedly include mechanisms that allow websites to gradually restrict how users manage their credentials, limiting interoperability and user choice.

Who is missing from the FIDO Alliance?

The FIDO Alliance membership lacks consumer advocacy groups, according to the report. This stands in contrast to the World Wide Web Consortium, which decides web standards. The absence of consumer representatives raises questions about whose interests are prioritized in the development and deployment of passkey technology across the internet.

What does this mean for operations?

For security operations teams, the lack of user control over passkeys presents a potential risk. If vendors can restrict credential management, organizations may face difficulties in auditing access or managing shared accounts. The report suggests that passkeys, while elegant on the surface, may hide troubling implications for long-term credential management and user autonomy.

Questions to ask your suppliers

Teams usually review authentication methods to ensure they align with organizational risk tolerance. Check whether the supplier’s passkey implementation allows for adequate audit trails and user management capabilities. Verify if the vendor provides clear documentation on how credentials are stored and who has access to them. Ensure that your identity management team is informed about any changes to authentication protocols that could impact incident response procedures.

What to do and how to stay safe: FIDO Alliance

• Review current authentication methods to identify reliance on passkeys or similar technologies.
• Assess whether your identity management tools provide sufficient visibility into passkey usage.
• Monitor vendor communications for updates on passkey implementation and potential restrictions.
• Once the vendor provides an update, evaluate any changes to credential management capabilities.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main criticism of passkeys in this report?

The report argues that passkeys remove user control over login credentials, unlike passwords or other authentication methods.

Who are the members of the FIDO Alliance?

The FIDO Alliance includes Big Tech companies, national governments, intelligence agencies, banks, and nonprofits like Mozilla.

Are consumer advocacy groups part of the FIDO Alliance?

No, the report notes that no consumer advocacy groups are members of the FIDO Alliance.