Google and Apple use passkeys to capture users by locking credentials into their platforms and have made the UX of passkeys worse than that of password managers
At around 11pm last night my partner went to change our lounge room lights with our home light control system.
Firstyear's blog-a-logWilliam Brown
Context & Ripple Effects
Google’s passkey rollout moved from account-wide availability to default prompts for Google users, positioning the credential system as a mainstream replacement path rather than an optional security feature.
Related coverage has also identified unresolved passkey UX issues despite the security promise. This critique matters because it frames usability and credential syncing as competitive control points for Apple and Google, not merely implementation details.
First-order effects
Users who rely on password managers may face a less consistent sign-in and recovery experience when passkeys are handled through Apple or Google platform flows.
Apple and Google gain a closer relationship to the credential layer on their devices, while the critique heightens scrutiny of whether users can move those credentials easily.
Second-order effects
Password managers have a clearer incentive to emphasize cross-platform passkey syncing and recovery, where platform-managed credentials are perceived as restrictive.
Services adopting passkeys must account for support and recovery friction across device ecosystems, rather than treating passwordless sign-in as a uniform user experience.
Third-order effects
If platform-specific credential handling persists, authentication could become another durable source of ecosystem switching costs, alongside operating systems and app distribution.
The longer-term contest may center on whether passkeys remain interoperable enough for users to choose credential managers independently of their device platform.
The trend: Passkeys are shifting authentication from a security upgrade into a contest over who controls the user’s identity and recovery layer across devices.
If you really want #passkeys put them in a password manager you control. But don't use a platform controlled passkey store, and be very careful with security keys. https://fy.blackhats.net.au/ ...
As an early adopter and proponent of Passkeys, it pains me to say I completely agree with this blog post. The UX of Passkeys is completely terrible and it's become crystal clear that Apple and Google have no intention of improving it. …
Passkeys: A Shattered Dream — I have of course been highly critical of Google's (and various other) passkey deployments. -L — https://fy.blackhats.net.au/ ... [image]
we have got to stop throwing the word “enshittification” around. also i'm wondering how a built-in security feature causes vendor lock-in? [embedded post]
Good post on the current state of Passkeys and Security Keys. “But don't use a platform controlled passkey store, and be very careful with security keys.” https://fy.blackhats.net.au/ ...
I'm still bullish on passkeys, but there's a lot of hard truths being told here that need to be addressed before passwords can be replaced. https://fy.blackhats.net.au/ ...
Industry can't help themselves but to screw up standards that could eliminate passwords. They always want to add their own little touch, which screws it up for everybody. They did it with OpenID, then OAuth, and now Passkeys. Whats' next? https://fy.blackhats.net.au/ ...
I was investigating passkeys for some work dashboards last month, the drawbacks made me drop it. They've made it impossible to do right for full easy authentication that was the dream. This guys describes it better (in multiple posts) than I ever could: https://fy.blackhats.net.a…
Passkeys work for BigCo, not you. My intro to this was working on Android and deploying internal version to test device. Upon reboot, it demanded the passkey I just wiped. Fortunately Chrome OS hadn't logged me out, or I would have lost my G account. https://fy.blackhats.net.au/ …