I’m an advocate for passkeys and I abolished passwords and embraced discoverable passkeys for our org’s key internal systems exclusively. So the battle cry of a title immediately put me on the defensive, unfortunately. The urge to not read is strong. A more measured title may help here.

But there’s definitely a kernel of truth here. 1Password recently began to enforce userVerification: required[1][2], and suddenly on the desktop without TouchID I have to enter my login password to use the passkey on a good number of websites. I didn’t sign up for 1Password 15 years ago so that I have to enter both my very complex master password and very complex login password to sign into websites, the “one password” contract is suddenly broken after 15 years. This experience independently alarmed me about the additional constraints potential of the passkey standard and power wielded by the FIDO Alliance and partnering organizations addressed in TFA, which are, to be clear, useful for security in an organization. (We use userVerification: preferred now btw.)

Therefore, I believe the passkey technology is great for enforcing a standard of security in an organization and stand by my choice for my org. But as a general purpose B2C auth tech, if the additional constraints become widely adopted, user freedom will be seriously harmed.

Edit: I asked Opus 5.5 to vibe code a passkey auth solution in Go a few times without saying anything specific about userVerification. It chose required each time. So expect to see more of these. Oh and vibe coding auth without understanding it entirely is bad, please don’t do that.

[1] https://web.dev/articles/webauthn-user-verification

[2] https://www.1password.community/1password-at-home-31/user-ve...

1Password suddenly offering to save passkeys without mentioning that they can't be exported to other apps (but are seamlessly synced between devices using 1Password) is what lost them "good guys" status in my mind.

It immediately creates a huge lock-in in a hard-to-notice way. Luckily, I did noticed early on and manually removed the 20 or so passkeys I had created.

Earlier this year, I lost my iPhone and restored from backup. I was shocked to see that I could log into my 1Password account using only the master-key, and that the secret-key was not required. 1Password clearly stated that the secret-key was required to setup a new device, but it turns out that they also (perhaps recently) configure it to upload to all devices in your iCloud account[1]. Ever since then, I've lost faith in 1Password's ability to communicate their security model to me and started looking for an off-ramp.

[1] https://support.1password.com/secret-key-security/

The vibecoding part is probably because "userVerification: required" is essential to have it work somewhat-securely as your sole form of security - like Passkeys is heavily promoting. Without it anyone with physical access to the device can use it to log in. This might not be so bad for a password manager which already has strict session password requirements and short timeout periods of its own, but it is a completely different story with, say, a Yubikey.

If you're building a Passkey-based login page and you specify "userVerification: preferred" or "userVerification: discouraged" you are essentially reducing your security to a single factor - namely the "something you have" one.

The change to 1Pass is annoying and I don't mention these to discount your valid concerns with it, only to make people aware of the options that can help with this and make it less taxing than continuously entering a password:

* On Windows you can enable Windows Hello for biometric authentication.

* On Mac, as shit as it is, you can buy Apple's magic keyboard with TouchID (for crazy money, but still) and use it while the notebook is shut.

I hope 1Password can eventually consider adding something like face recognition from a webcam as an alternative method.

Unfortunately, without this they are not compliant and it gives a false sense of security to claim it is multi-factor when it's actually only one factor. You'll find the same with other Passkey stores like Kevault that require biometrics as well.

Substitute the title for Passkeys Considered Harmful.