Why I still shun passkeys

This blog post is not about passkey attestation. I have no strong opinion on the subject that has inspired a controversy over the past few days. However, the controversy did inspire me to write about passkeys again, and passkeys do currently feel like a trap to me, for reasons other than attestation. Admittedly, my reasons may be specific to the Apple ecosystem, as someone who stumbled into a career writing software for Apple devices, with no financially viable alternative. Three years ago I expressed skepticism of passkeys in a blog post, Passkeys: A loss of user control? Since then, the major credential manager vendors have adopted a credential exchange protocol to migrate passkeys between credential managers. Although I’m not impressed that the vendors promoted passkeys for years without this essential feature, it’s better late than never. The credential exchange protocol nevertheless contributes nothing toward mitigating my previous concerns about passkeys, because I have no…