Google and Apple use passkeys to capture users by locking credentials into their platforms and have made the UX of passkeys worse than that of password managers
At around 11pm last night my partner went to change our lounge room lights with our home light control system.
Firstyear's blog-a-logWilliam Brown
Context & Ripple Effects
Google’s passkey rollout moved the technology from an optional security feature toward a default account path, including prompts to create a passkey by default after it enabled passkeys across Google accounts. That makes the storage and recovery experience materially important rather than a niche implementation detail.
Related coverage already described a promising security model whose user experience still needed work. This critique focuses that gap on whether platform-controlled credential syncing is less usable—and less portable—than established password managers.
First-order effects
Users whose credentials are tied to Apple or Google account ecosystems may face more friction when signing in or recovering access across devices than they do with independent password managers.
Apple and Google gain greater influence over the credential layer as passkey creation becomes part of their account and device experiences.
Second-order effects
Password managers are pushed to improve passkey syncing and cross-platform workflows, because usability and portability become their clearest differentiation from platform-native tools.
Services adopting passkeys may need to preserve password or alternative recovery paths while platform-specific credential flows remain inconsistent for some users.
Third-order effects
If credentials remain easiest to use inside the operating-system vendor’s ecosystem, authentication can become another durable form of platform credential lock-in, raising the value of interoperable export, syncing, and recovery mechanisms.
The long-run contest is not only whether passkeys replace passwords, but whether the passkey layer remains contestable among platforms and password managers; that outcome depends on whether cross-platform UX improves.
The trend: Passkeys are turning authentication from a standalone security feature into a platform-controlled access layer, with portability and recovery emerging as the key competitive fault lines.
If you really want #passkeys put them in a password manager you control. But don't use a platform controlled passkey store, and be very careful with security keys. https://fy.blackhats.net.au/ ...
As an early adopter and proponent of Passkeys, it pains me to say I completely agree with this blog post. The UX of Passkeys is completely terrible and it's become crystal clear that Apple and Google have no intention of improving it. …
Passkeys: A Shattered Dream — I have of course been highly critical of Google's (and various other) passkey deployments. -L — https://fy.blackhats.net.au/ ... [image]
we have got to stop throwing the word “enshittification” around. also i'm wondering how a built-in security feature causes vendor lock-in? [embedded post]
Good post on the current state of Passkeys and Security Keys. “But don't use a platform controlled passkey store, and be very careful with security keys.” https://fy.blackhats.net.au/ ...
I'm still bullish on passkeys, but there's a lot of hard truths being told here that need to be addressed before passwords can be replaced. https://fy.blackhats.net.au/ ...
Industry can't help themselves but to screw up standards that could eliminate passwords. They always want to add their own little touch, which screws it up for everybody. They did it with OpenID, then OAuth, and now Passkeys. Whats' next? https://fy.blackhats.net.au/ ...
I was investigating passkeys for some work dashboards last month, the drawbacks made me drop it. They've made it impossible to do right for full easy authentication that was the dream. This guys describes it better (in multiple posts) than I ever could: https://fy.blackhats.net.a…
Passkeys work for BigCo, not you. My intro to this was working on Android and deploying internal version to test device. Upon reboot, it demanded the passkey I just wiped. Fortunately Chrome OS hadn't logged me out, or I would have lost my G account. https://fy.blackhats.net.au/ …
Passkeys create a public-private key pair. The private key can be stored in any secure secrets store. The default on Apple devices is to store it in iCloud Keychain & automatically sync it to all your iCloud-connected devices. …
I set up a pass key for an account on my Mac. Months later I reset my Mac and then could no longer log into my account because the passkey was no longer on my device. I think it is device specific because I could never log on via my phone either. Since then I stopped using pas…
I'm betting most folks in the Apple ecosystem have been stung by Apple's *unique* 2FA implementation. “A message with a verification code has been sent to your other devices...” So forgive us if we're a little leery of trusting iCloud to have our backs with Passkeys, like when w…
“Passkeys” needs better marketing. What if I could tell you that you... - never have to remember or change another password again - never have to worry about your passwords being compromised - could effortlessly sign in to every website and app with FaceID and could do all that …
A side effect of the dominant web browsers also being developed by the dominant mobile platform companies (Apple & Google) is that the open web can never reach its full potential and match mobile apps. It would literally lose them billions so instead we get small improvements. [i…