> What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.

Use proper password managers, like keepassxc. Then you have control. But problem is that not all sites support that. If you can't use the above - then yes, passkeys are bad, especially if they become mandatory.

▲

turtletontine 5 hours ago | parent [-]

If you keep reading the article, you’ll see that the claim is current (unattested) passkeys are a stepping stone to “attested passkeys”. Attested passkeys would require remote attestation with OS, TPM, and password manager all working together, and would allow websites to require things like hardware backed non transferable passkeys that you don’t control. This has always been my suspicion and I do think it’s worth worrying about.

▲

shmerl 4 hours ago | parent [-]

Sure, if they are actively pushing for that, it's bad. But otherwise passkeys are OK. It's a neat way to use private / public key pair instead of a dummy password.

	▲	tavavex 2 hours ago \| parent \| next [-]
		This is already in the spec. It's not some faraway hypothetical, they could start requiring this tomorrow if they wanted to. And if you're capable of seeing any trends wrt the 'attestation' and 'securing' everything that are already here, you will know that all they're waiting for is for a significant enough portion of users to get passkeys on their platforms naturally, and then just force everyone else.
	▲	cowlevel 3 hours ago \| parent \| prev [-]
		They are actively pushing for that.