TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Non-Functional essay argues that passkeys may reduce users’ control over how credentials are stored and recovered, despite offering security advantages over passwords. The supplied excerpt does not establish that passkeys are inherently unsafe or that users should avoid them; implementation and recovery options vary, and the essay’s claims need to be weighed against those details.
Non-Functional has published an argument against adopting passkeys, warning that the credentials can leave users with less control over storage, sharing and recovery than passwords or authenticator-app codes. The essay acknowledges that passkeys can be more secure and convenient than passwords, but its supplied excerpt does not show that passkeys are generally unsafe or that all services handle them the same way.
The essay’s central concern is who controls a passkey after a person creates it. Its author contrasts passkeys with passwords, which users can write down or store with a chosen service, and time-based one-time password codes, which can be generated by different compatible apps or devices. The essay argues that passkeys may tie people more closely to the platforms and websites that support them, particularly when access must be restored or credentials moved.
As an alternative, the author points to TOTP authenticator codes, which change periodically and are generated using a shared standard. The essay says users can choose among compatible software and hardware rather than being required to use a particular company’s app. That comparison reflects the author’s case for flexibility; it does not establish that TOTP is preferable for every user or account.
The article also questions the makeup of the FIDO Alliance, the industry consortium associated with passkey standards, saying its membership includes technology firms, governments, banks and other organizations but no consumer advocacy groups. The excerpt offers the author’s assessment of member interests, not evidence that those organizations designed passkeys to harm users. It does not include comment from the alliance, platform operators or consumer groups.
Control After a Passkey Is Created
The debate matters because login methods affect both account security and access. Passkeys can reduce exposure to phishing and reused or weak passwords, but people also need reliable ways to sign in after losing a device, changing platforms or losing access to an account. A method that is secure during routine use can still create difficulties if recovery options are limited or unclear.
The essay’s focus on user choice and portability gives readers a reason to examine how a specific service stores passkeys and handles recovery before changing their login setup. But the broad instruction in its headline, “Do not use them,” goes beyond what the excerpt establishes: it presents a critical argument, not comparative testing showing that passkeys are unsafe across services.
As an affiliate, we earn on qualifying purchases.
Passwords, Codes and Passkey Adoption
Websites have promoted passkeys as an alternative to passwords. The essay accepts the familiar security problems with passwords and cites examples of weak or exposed credentials, including a password attributed to SolarWinds and a password visible in a photograph connected to Hawaii’s emergency management agency. These examples illustrate risks associated with poor password practices; they do not by themselves compare passkeys with other authentication methods.
The author says two-factor authentication and TOTP codes already offer protection beyond passwords. TOTP codes are generated from a secret seed and the current time, using a public standard, and typically expire after a short period. The excerpt’s point is that users may have choices in the software used to generate them. It does not discuss the full range of passkey designs or establish that every passkey is locked to a single provider.
As an affiliate, we earn on qualifying purchases.
Passkey Recovery Remains Unexamined
The supplied excerpt does not give technical details about how particular passkey systems store, sync, export or recover credentials. It also does not establish whether users can maintain backup passkeys, use multiple devices, or recover accounts through a service’s other sign-in methods. These details can differ by platform and website, so the article’s broad claims about control cannot be assessed fully from the excerpt alone.
There is also no response from the FIDO Alliance or named technology providers, and no consumer-advocacy assessment is included. The excerpt ends during its discussion of sharing TOTP codes, leaving part of the author’s comparison unavailable. Readers should treat the headline’s instruction as the essay’s opinion, not as a confirmed security advisory.
password manager with credential backup
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Check Each Service’s Recovery Options
No formal response, new policy or follow-up study is identified in the supplied material. For now, readers considering passkeys can review a service’s backup and account-recovery procedures, check which devices or providers can access synced credentials, and keep an available recovery method where the service permits it. They should also consider the risks of their alternatives, including password reuse and the security of authenticator backups.
Further reporting would need to compare specific passkey implementations, recovery processes and user experiences, and seek comment from the FIDO Alliance, service providers and consumer groups. Until those details are available, the excerpt supports a debate about convenience, security and user control, not a blanket conclusion that passkeys should never be used.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the actual development in this story?
Non-Functional published a critical essay arguing that passkeys may reduce users’ control over credential storage and recovery. The supplied material does not identify a new technical change or security incident.
Does the essay prove that passkeys are unsafe?
No. The excerpt acknowledges that passkeys can be more secure than passwords and argues primarily about user choice and control. It does not present independent testing showing that passkeys are unsafe overall.
What alternative does the author recommend?
The author favors time-based one-time password codes generated by authenticator software or hardware. The excerpt makes this case as an argument; it does not show that TOTP is the best choice for every person or account.
What should users check before enabling a passkey?
Check how the service handles device changes, backups and account recovery, and whether alternative sign-in methods remain available. Options differ between services, and the supplied excerpt does not assess particular implementations.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
