Passkeys are the FIDO Alliance's replacement for passwords, and the pitch is straightforward: stronger cryptography, no phishable secrets, no reusable credentials. All true. But the author of this analysis — a technically detailed breakdown circulating on Hacker News — argues the real story is not the cryptography but the control surface. Unlike passwords or TOTP seeds, which are inert data you can store, copy, and share however you like, passkeys come with a suite of optional capability flags that websites can set unilaterally: copyable or non-copyable, transferable or non-transferable, attested or unattested, hardware-backed or software-backed. The user doesn't choose these properties. The website does. The FIDO Alliance itself is the consortium behind the standard. Its membership includes Apple, Google, Microsoft, major banks, intelligence agencies, and national governments — but notably zero consumer advocacy organizations. The author contrasts this with the W3C, which includes universities, public interest groups, and Tim Berners-Lee. The absence matters because passkey design decisions that could lock users into specific platforms or prevent credential sharing are being made by exactly the parties who benefit from lock-in. The technical architecture is worth understanding. TOTP (time-based one-time passwords) runs on an open formula — RFC 6238 — and any device that can tell time can generate codes. You can write the implementation yourself in Python. You can store your seeds on paper if you want. Passkeys also have an open standard (WebAuthn), but the standard reads less like a specification and more like a parts catalogue of optional features. That optionality is the trap: a website can require hardware-backed, non-copyable, non-transferable, attested passkeys, and you have no recourse. The same word — 'passkey' — covers both a user-friendly exportable credential and a platform-locked hardware token you cannot back up. The deliberate naming collision is the sharpest point in the analysis. The FIDO Alliance uses 'passkey' to describe fundamentally different credential types with different user rights. A copyable software passkey you can email to a friend and a non-copyable hardware-attested credential locked to your iPhone's secure enclave are both called 'passkey.' The author argues this conflation is intentional — it discourages users from examining which kind they're actually creating and what rights they're surrendering. The extractive logic becomes clear when you follow the incentive chain. Netflix doesn't want you sharing passwords. Banks want non-repudiable authentication that shifts liability to users. Platform vendors want credentials locked to their hardware ecosystems. Intelligence agencies want attestation that ties credentials to specific devices. None of these interests are illegitimate on their own, but they all point the same direction: away from user autonomy and toward institutional control over the authentication layer. The existing alternatives are not hypothetical. TOTP already solves the core phishing problem passwords create — leaked codes expire in 30 seconds — while preserving user sovereignty over credential storage. Physical security keys (FIDO U2F) provide hardware-grade security with user-controlled possession. The author's point is not that passkeys are technically inferior but that the standard was designed with dials that can be turned against users over time, and the consortium turning those dials has no one at the table arguing for the user. Twenty years of this trajectory means authentication becomes a platform-controlled chokepoint. If passkey attestation becomes mandatory and only Apple, Google, and Microsoft hardware can produce attested credentials, then access to digital services becomes gated by device vendor approval. The password — for all its flaws — was the last credential type where the user had unilateral control. Its replacement was designed by a consortium that does not include the user.
