If, like me, you’re tired of racking up an endless list of variations of letters, numbers and special characters, written in your own blood under a full moon, just to watch a movie or buy some tat online, this newfangled ‘passkey’ business may sound appealing. Because, like me, you probably have no real idea of what a passkey is or what risks they may carry.
In fact, you should probably operate on the principle that if Big Tech wants you to do it, you probably shouldn’t comply.
We are told, with the unctuous piety of a Silicon Valley PR flack, that passwords are dead and that passkeys are the glorious, friction-free dawn of a secure digital tomorrow. How wonderful! How brilliantly streamlined! Just flash your keester at a glowing slab of glass or tap a thumbprint against an inscrutable pane and presto: doors open, commerce flows and the technocratic oligarchy sighs with benevolent relief.
Except, as any student of history or corporate chicanery knows, whenever a conglomerate of trillion-dollar monopolies and national security agencies suddenly agree that a particular innovation is for your own good, it’s generally time to check whether your wallet is still in your pocket.
To understand the Trojan horse that is the passkey, one must examine its architects. These digital marvels are the handiwork of the FIDO Alliance, a cosy little consensus club comprising Big Tech monoliths, intelligence apparatuses, banking institutions and sundry bureaucrats. Notice anyone missing? Perhaps a consumer advocate or two? Not a soul.
As The Hack Substack neatly observes in its incisive critique of the technology:
The members of the FIDO Alliance all have their own interests. Big Tech wants to bring little inconveniences into our life so they can sell us more ads. Intelligence agencies want to track everyone in the world. Banks want to be free of indemnity. Little tech wants cheap solutions to reduce liability.
Exactly. Passwords, for all their annoying eccentricities and vulnerability to human forgetfulness, possessed one supreme virtue: they belonged to you. You could scribble them on a greasy napkin, store them in a dog-eared notebook or share a login with a cousin without asking permission from the high priests of Cupertino or Mountain View.
Indeed, if we sought superior security without surrendering sovereignty, we already possessed a magnificent invention: Time-Based One-Time Passwords (TOTP). If you’ve ever used a bank token thingy that generated a one-time code for you, it was a TOTP. Based on open standards like RFC 6238, TOTP requires nothing more sophisticated than a standard mathematical algorithm that can run on anything from a modern laptop to a vintage Nintendo Game Boy from the 1990s. It asks no permission, reports to no overarching server and permits you to handle your digital keys precisely as you see fit. Naturally, Netflix detests it and Big Tech pretends it doesn’t exist.
Enter the passkey, which masquerades on the surface as a friendly, frictionless cousin to TOTP, but is in reality a labyrinthine parts catalogue of restrictions. The FIDO Alliance has deliberately gathered a bewildering assortment of technical criteria under a single, cosy, trade name to lull the public into somnolent compliance. Under the hood, passkeys can be copyable or non-copyable, transferable or non-transferable and hardware-backed or software-backed.
At first glance, one might assume these are merely bespoke settings tailored to the consumer’s preference. But here’s where the velvet glove slides off to reveal the iron fist of remote attestation.
Through the magic of hardware-level cryptoprocessors embedded in modern devices – Apple’s Secure Enclave, Trusted Platform Modules and the like – platforms will soon be able to verify not merely who you are, but what software you are running to get there. If your operating system has been modified, if you are running an alternative privacy-respecting setup like Linux or GrapheneOS or if you dare to use a custom web browser that blocks intrusive advertisements and state-sanctioned AI surveillance summaries, or you use the bête noire of the eKarens, a VPN, the system will lock the gates.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
In fact, as Josh Albrecht comments on The Hack’s Substack:
Cops can literally hold your phone up to your face, unlock it, and go digging for anything at all that they could use to charge you.
This is in stark contrast to passwords, where (because they are speech) you cannot easily be compelled to reveal them (and even if you do, there are often ways of encrypting data with multiple passwords, so that someone can control which of it is revealed).
And there it is: The ultimate endgame of the passkey ecosystem has precious little to do with stopping Eastern European hackers from guessing your Netflix password. It is about total environmental control. It is about locking down the digital commons so thoroughly that no dissident can run unapproved software, no independent journalist can browse anonymously and no citizen can escape the unblinking gaze of the corporate-state surveillance complex.
The technocrats want a world where your phone is no longer your property, but a tethered terminal leased to you on good behaviour. If you value your digital independence – if you believe in the quaint notion that individuals should control their own hardware and choose their own software – then reject this clever little trap. Stick to open standards, keep your own counsel and let Big Tech manage its own anxieties without your assistance.
