Are Passkeys a Trap? Fact-Checking a Viral Warning

A Substack post going around says passkeys are a trap and nobody should use them. I read it, then checked its claims against the specs, vendor docs and NIST guidance. Short version: the author spotted a real long-term risk and then oversold it. “Don’t use passkeys” is bad advice for most people. “Don’t trust them blindly” is fair.

What the post claims

Passkeys aren’t one thing. Some copy across devices, some don’t. Some sit in a secure chip, some are plain files. Websites can see which type you made, and through attestation they can verify what software made it. So, the author argues, sites could eventually accept only approved software, handing big tech, banks and governments a veto over what you run. The suggested fix: authenticator-app codes (TOTP) or a hardware key.

Where the post is right

• Sites can see what kind of passkey you have. WebAuthn flags tell a site whether a credential is synced or device-bound. WebAuthn Level 3, which formalizes them, became a W3C Recommendation on August 25, 2026.

• Sites can block providers. Auth vendors sell allow-lists and block-lists by authenticator model, and warn that switching them on can lock out users who are already enrolled. Banks are the target customer.

• The people writing the rules aren’t you. FIDO’s board includes banks, payment networks and big platforms, and governments have had a seat since 2015. I found no consumer group on the public member list, though I only saw part of it.

• Device checks already lock people out. GrapheneOS users report banking and ID apps refusing to run because of Google’s Play Integrity checks. That isn’t passkeys, but it shows the worry is real.

• Moving passkeys has been painful. FIDO published a transfer standard (CXP and CXF) as a proposed standard in March 2026. I couldn’t confirm which providers actually ship it.

Where it falls apart

The claim that attestation is coming for everyone. Not on the evidence. The default is no attestation, and Apple and Google don’t send any for synced passkeys. Yubico’s own guidance says rejecting credentials without attestation will probably reject Apple, Google and Microsoft passkeys. Those providers hold over 90 percent of passkeys by one industry estimate, so a consumer site demanding attestation would shut out most of its own customers. That is a commercial brake, not a guarantee, but it is a real one.

The claim that attestation inspects your whole device. In the consumer flows I reviewed, it identifies the make and model of the authenticator. Whether your operating system is approved is checked by other systems, like Play Integrity or Apple’s App Attest. Some platform formats expose more, so the worry isn’t baseless, but I found no mainstream site using passkeys that way.

The claim that intelligence agencies are members. I couldn’t confirm it. The government members I could identify are standards and cybersecurity bodies such as NIST. That doesn’t prove no one else is involved, but the post doesn’t back the claim up.

The nudity scanner. The UK plan covers devices used by under-18s. The government describes on-device blocking with no data collection or reporting, and it doesn’t stop adults viewing anything. Nothing I found ties it to passkeys. The post’s wording implies a universal, mandatory scanner. That overstates what the policy says.

TOTP as the safe choice. TOTP gives you freedom, but it can be phished: a fake login page grabs your code and replays it in real time. A passkey is bound to the real site’s domain, so a fake site gets nothing. NIST treats that binding as what makes a credential phishing-resistant, and says properly deployed synced passkeys can meet its AAL2 level. The post mentions this only in a footnote, and admits the author would like to recommend passkeys. So the headline says one thing and the author’s own footnote says another.

The claim that you don’t control your passkeys. You have choices. 1Password, Bitwarden, Dashlane and Proton Pass all store passkeys. Few people use them, about 1 to 2 percent of new passkeys by one estimate, so platform defaults decide it for everyone else.

The risk the post barely touches

You can lose them. A passkey can’t be reset by email like a password. Lose every copy, or the account that syncs them, and you can be locked out. For ordinary users that is a more likely problem than attestation lockouts, which I found no consumer site enforcing.

So, trap or not?

Not today. The standard does contain hooks, such as attestation, backup flags and provider allow-lists, that could be used to narrow your choices, and that is worth watching. But the threat is policy, not cryptography, and so far it is speculation. Meanwhile phishing and reused passwords are happening right now, and passkeys are designed to close both holes.

What I’d actually do

1. Turn on passkeys for your email, banking, and Apple, Google or Microsoft account.

2. Register two: a second device, a security key, or a manager not tied to your phone. Save the recovery codes.

3. Pick a manager that can export, and check whether it supports FIDO’s transfer standard.

4. Keep a hardware key or TOTP as a backup. TOTP works, but remember it can be phished.

5. Watch for red flags: a site that rejects your passkey manager, forces its app, or demands a specific device. Tell the site, and look for alternatives.