2026-09-08 17:46 UTC
Replies (2)
-
@rickhunter@infosec.exchange 2026-09-08 18:13
@Xavier@infosec.exchange @drsbaitso@infosec.exchange A website should never tell the browser to accept a passkey without the user explicitly requesting to create it. Good: My pharmacy notices that I don't have a passkey after logging it. It asks if I want to create one now and respects my decision if I decline. Bad: Amazon spontaneously telling my browser to save a passkey when all I've done is open my Order History page. That passkey dialog should never pop up by surprise, in the middle of an unrelated workflow.
-
@drsbaitso@infosec.exchange 2026-09-08 18:44
@Xavier@infosec.exchange I would start voluntarily using passkeys when I feel like I have meaningful control and understanding over them. The fact that I can't disable passkey support and instead have to make sure that one isn't being created and stored somewhere means that now I don't trust login flows to not break my ability to use a website from another device. When my insurance company starts assuming that it can force a passkey on my account and that I want a specific device to be able to log in in the future makes me deeply suspicious of why they're suddenly so concerned about it. I've been burned by terrible, broken passkey implementations and combined with the lack of transparency and control, I'm just not interested.