TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Non-Functional essay argues users should be wary of passkeys because, in its view, they can limit control over how credentials are stored and recovered. The piece acknowledges that passkeys can improve security, but its broad recommendation not to use them is an argument, not an official warning or evidence that passkeys are inherently unsafe.
Non-Functional has published an essay arguing against passkeys, saying the credential system can reduce users’ control over storage and access. The author acknowledges that passkeys may be more secure and convenient than passwords, but argues that the trade-offs deserve attention as websites promote passkey sign-ins.
The essay’s central concern is who controls a passkey and how it can be moved or recovered. It contrasts passkeys with passwords, which users can write down or store with a chosen service, and physical security keys, which users can hold themselves. The author says websites and platform providers may shape what users can do with passkeys over time. The supplied text does not detail the specific mechanisms behind that claim or document a case in which a provider removed a user’s access.
The author also challenges the claim that passkeys are needed to address password weaknesses. The piece points to time-based one-time passwords (TOTP), commonly generated by authenticator software, as an alternative second factor. It describes TOTP as based on a public standard, RFC 6238, and says users can choose compatible software rather than being tied to one named app. That description is the essay’s account; it does not establish that TOTP and passkeys offer identical protections in every situation.
The report criticizes the composition of the FIDO Alliance, which it identifies as the organization behind passkeys, arguing that its members include corporate and government interests but no consumer advocacy groups. That is the author’s characterization of representation and incentives, not evidence that the alliance designed passkeys to harm users. The supplied excerpt ends during its discussion of TOTP and does not provide a complete technical comparison or a response from the FIDO Alliance.
The Trade-Off Is Control and Security
The debate matters because sign-in credentials govern access to email, financial services and other accounts, and users may have to choose among methods that differ in security, convenience, portability and recovery. Passkeys are presented by many services as a replacement for passwords; an argument that they can constrain user choice is relevant to people deciding whether to accept a sign-in prompt or retain other options.
But the essay’s headline, “Do not use them,” goes further than the evidence in the supplied material. The author concedes passkeys can be more secure and convenient, while raising concerns about control. Readers should treat the piece as a critique and a call for scrutiny, not as a finding that passkeys are unsafe across providers or that TOTP is a universally equivalent substitute. The article offers no comparative test results, incident data or policy documents establishing those broader conclusions.
hardware security keys for two-factor authentication
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Passwords, TOTP and Passkeys
The essay begins from a widely recognized weakness of passwords: people may choose easy-to-guess combinations, reuse them, or have them exposed. It cites examples involving a weak password associated with SolarWinds and a password visible in a photograph connected to Hawaii’s Emergency Management Agency. These examples illustrate password risks, but the excerpt supplies no sourcing or dates for them, so they should not be treated here as independently verified case details.
It then describes TOTP as an additional login factor: software generates a short-lived code using a shared secret and time, which a service can check. The essay says this approach allows users to select compatible tools and does not require a smartphone. Passkeys are the alternative under criticism, but the provided material does not explain their technical design in detail. It therefore cannot support a full comparison of how passkeys and TOTP handle phishing, device loss, account recovery or cross-device use.
The Evidence Behind the Warning
The supplied material does not establish which passkey systems or providers limit user control, what restrictions apply, or whether users can export, sync or recover credentials under the scenarios the author has in mind. It also does not cite consumer research, technical evaluations or responses from the FIDO Alliance and passkey providers.
The comparison with TOTP remains incomplete in the excerpt. It does not assess account recovery, phishing resistance, usability or the risks of storing authentication secrets, and it does not show that a TOTP code is an adequate replacement for a passkey in every service. The publication date is also not included in the source material, making it unclear when the essay appeared.
Check Provider Policies Before Switching
Readers considering a passkey can check the relevant service’s recovery, device-sync and credential-management options before changing their sign-in method. They can also see whether the service allows another factor or backup method. The essay itself does not offer a complete decision guide or establish that users should disable passkeys.
No response from the FIDO Alliance or a passkey provider is included in the supplied material, and no policy change or formal security advisory is reported. Further reporting would need to examine specific providers’ rules and compare the available authentication methods, rather than treating the essay’s general warning as a confirmed industry-wide outcome.
Key Questions
What is the news in this report?
Non-Functional published an essay criticizing passkeys over concerns about user control and advising readers not to use them. The provided source does not include a publication date.
Does the essay say passkeys have no security benefits?
No. The author explicitly acknowledges that passkeys can be more secure and may be more convenient than passwords, while arguing that other concerns should affect users’ decisions.
What alternative does the essay discuss?
It discusses time-based one-time passwords (TOTP), codes generated by compatible authenticator software. The excerpt presents TOTP as an alternative second factor, but does not prove it is equivalent to passkeys for every service or threat.
Does the source prove passkeys take control away from users?
No. The essay raises that concern, but the supplied text does not document a specific provider restriction, explain the mechanisms in detail or include a response from the FIDO Alliance.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
