Opinion: Passkeys Hand Control to Big Tech
Original: Passkeys are a trap. Do not use them
Why This Matters
Passkey adoption is accelerating; who controls the standard shapes billions of logins.
A Substack essay argues passkeys, backed by the FIDO Alliance—a coalition of Big Tech, banks, and intelligence agencies—strip users of credential ownership, unlike passwords or authenticator apps, with no consumer advocates at the table.
A widely-shared opinion piece from the 'Non-Functional' Substack warns non-technical users against adopting passkeys, arguing that while the technology is genuinely more secure than weak passwords, it quietly transfers control of login credentials away from users and toward platform providers. The author's core concern: unlike passwords, which users can store anywhere, or hardware security keys, which can be physically handed off, passkeys come with a vendor-controlled dial that websites can turn to progressively restrict what users can do with their own credentials. The FIDO Alliance, the consortium behind passkey standards, counts Big Tech, national governments, intelligence agencies, and banks among its members—but zero consumer advocacy groups. The essay contrasts this with the W3C, which includes public interest organizations and academic institutions. The author concedes passwords have real weaknesses—citing SolarWinds' infamous 'solarwinds123' breach and Hawaii's sticky-note password incident—but argues that problem was already solved by two-factor authentication and hardware keys before passkeys arrived. The piece is aimed explicitly at non-technical readers and stops short of a technical deep-dive, but the governance critique is pointed: when no one at the standards table represents users, the standard won't protect them.