TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Non-Functional essay argues that passkeys can reduce users’ control over where credentials are stored and how they are moved between services. It acknowledges that passkeys can improve security, but its broad warning is an opinion, not evidence that passkeys are inherently unsafe or that authenticator codes are a complete substitute.
Non-Functional has published an essay arguing that users should avoid passkeys because the credential system can leave them with less control over storage and transfer than passwords or authenticator codes. The author acknowledges that passkeys can be more secure and convenient than passwords, but says adoption also raises questions about portability and who sets the rules; the supplied material does not establish that passkeys are inherently unsafe.
The essay’s central concern is user control. It says passkeys are tied to a device or a provider’s account ecosystem in ways that may make them harder to manage or move than passwords and time-based one-time passwords, or TOTP codes. The author contrasts this with passwords, which users can store where they choose, and authenticator apps, which can use a publicly specified method to generate codes.
The author argues that passkeys are promoted by the FIDO Alliance, whose membership spans technology firms, financial institutions, governments and other organizations. The essay says consumer advocacy groups are not represented among the alliance’s members and questions whether users’ interests receive enough weight. That is the author’s assessment of representation and incentives; the supplied material does not independently document the alliance’s membership or establish that its standards harm users.
The essay also challenges the claim that passkeys are needed to solve password insecurity. It points readers to TOTP authenticator codes, which are generated locally from a shared secret and the current time, and says users can choose compatible software rather than relying on a particular app. It does not provide comparative testing or evidence that TOTP offers equivalent protection in every situation, and it does not discuss all recovery and account-access trade-offs.
The Trade-Off Behind Passkey Adoption
The debate matters because login credentials govern access to email, financial accounts and other services, while users may have limited choices once a website promotes one method over another. A credential that is harder to phish can reduce one class of risk, but account recovery, device loss and dependence on a platform can also affect whether a person can regain access.
The essay’s warning is best read as a call to examine those trade-offs, rather than as proof that readers should reject passkeys. The source recognizes potential security advantages but does not quantify them or compare them with TOTP. Readers choosing an authentication method should distinguish security against credential theft from portability and recovery, which are related but separate concerns.
As an affiliate, we earn on qualifying purchases.
Passwords, TOTP and Passkeys
The essay describes passwords as familiar and flexible, but vulnerable when they are weak, reused or exposed. It cites examples of poor password practices, including a password attributed to SolarWinds and a password visible on a sticky note in a photograph associated with Hawaii’s Emergency Management Agency. These examples illustrate risks; the supplied text does not provide independent sourcing or further details for them.
It presents TOTP as an alternative to codes delivered by text or email: an authenticator generates a short-lived numeric code using a secret and the current time. The source refers to RFC 6238 as the public specification for the method. Passkeys are also described as an alternative to passwords, but the supplied excerpt ends before fully explaining the technical mechanism behind the author’s concern about control.
As an affiliate, we earn on qualifying purchases.
What the Essay Does Not Establish
The supplied source is an argument, not a technical audit or comparative study. It does not show how frequently users lose access to passkeys, whether particular providers restrict transfer, or how recovery works across different implementations. Its excerpt also stops before the author’s promised explanation of how websites might reduce users’ control.
It is also unclear from the material whether the author’s claims about FIDO Alliance membership are current, and no response from the alliance or passkey providers is included. The text does not compare passkeys and TOTP across phishing resistance, account recovery, device changes or accessibility. Those details would be needed to assess the recommendation to avoid passkeys as a general rule.
password manager with backup options
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Questions for Providers and Users
The next useful step is for passkey providers and websites to explain, in plain language, where credentials are stored, how users can recover accounts, and whether credentials can be moved or backed up. Those details vary by implementation and are not supplied in the essay excerpt.
Users weighing the options can check which authentication and recovery methods a service supports, and avoid relying on a single device or account without understanding recovery arrangements. Further reporting or technical documentation would be needed to resolve the essay’s claims about portability and to compare passkeys with TOTP on a like-for-like basis.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does the essay prove passkeys are unsafe?
No. It presents an argument about control and portability, while acknowledging that passkeys can be more secure than passwords. The supplied material does not include evidence establishing that passkeys are inherently unsafe.
What alternative does the author recommend?
The author favors time-based one-time passwords (TOTP) generated by authenticator software. The essay says the method is based on a public specification and does not require one specific app, but it does not establish that TOTP is the best option in every case.
The essay argues users may have less control over where passkeys are stored and how they are managed or transferred than they do with passwords or TOTP. The excerpt does not fully explain the technical mechanism behind that concern.
Are passwords a safer choice?
The essay does not establish that passwords are safer. It acknowledges their security weaknesses and argues that users have more choice over how to store them. A choice of login method involves separate questions about security, recovery and portability.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
