Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site. Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
Overall, it feels like yet another complicated technology, that also allows big companies to consolidate power.
Every conclusion you just made is wildly incorrect, or at the very least misleading or misunderstood.
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
If you lose your Amazon passkey, you can switch back to another 2FA method. Same for Google, and honestly, every other place I have a passkey in play. Adding a passkey doesn’t delete your password or other 2FA.
Losing your phone usually doesn’t lose your passkeys anyway. Apple, Google, 1Password, and Bitwarden sync them, so they come back when you sign in on a new device.
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site.
Apple’s and Google’s synced passkeys provide no attestation, so a website can’t cryptographically tell which password manager made them.
A site can read the provider ID (AAGUID), but without attestation it’s self-reported and can be faked, so in the wild it’s useless as a way to block people. It’d be no different from Google requiring you to use Chrome, which they could already do today, but don’t.
Enforced provider restrictions do exist, but only in controlled enterprise setups with hardware keys or managed authenticators, like Entra ID allowlists.
Also, to note: Google Authenticator is a TOTP app. It’s not where Google stores passkeys.
Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
Out of date. Apple added passkey export/import in iOS/macOS 26, and Google added it to Google Password Manager in June 2026. Microsoft is the holdout: it can import but not export yet. Bitwarden also lets the end user export passkeys. The industry standard is built to move passkeys app-to-app, not as plaintext files that could be exfiltrated.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
He asked the KeePassXC project to “put basic protections in place and collaborate with the ecosystem/industry,” and said attestation would allow RPs (websites) to block it. The pressure was real, but it was a warning about plaintext export, not a plan to lock people in. A plaintext passkey file can be grabbed by malware or talked out of someone by a scammer, which is why the industry built an app-to-app transfer standard instead.
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
There’s a lot of other better reasons to stop using amazon, but if that’s the one for you, it’s still a victory if you stop using them.
What’s wrong with passkeys? my preferred method. Hell I wish everything just used those and no email password shit
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site. Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
Overall, it feels like yet another complicated technology, that also allows big companies to consolidate power.
Every conclusion you just made is wildly incorrect, or at the very least misleading or misunderstood.
If you lose your Amazon passkey, you can switch back to another 2FA method. Same for Google, and honestly, every other place I have a passkey in play. Adding a passkey doesn’t delete your password or other 2FA.
Losing your phone usually doesn’t lose your passkeys anyway. Apple, Google, 1Password, and Bitwarden sync them, so they come back when you sign in on a new device.
Apple’s and Google’s synced passkeys provide no attestation, so a website can’t cryptographically tell which password manager made them.
A site can read the provider ID (AAGUID), but without attestation it’s self-reported and can be faked, so in the wild it’s useless as a way to block people. It’d be no different from Google requiring you to use Chrome, which they could already do today, but don’t.
Enforced provider restrictions do exist, but only in controlled enterprise setups with hardware keys or managed authenticators, like Entra ID allowlists.
Also, to note: Google Authenticator is a TOTP app. It’s not where Google stores passkeys.
Out of date. Apple added passkey export/import in iOS/macOS 26, and Google added it to Google Password Manager in June 2026. Microsoft is the holdout: it can import but not export yet. Bitwarden also lets the end user export passkeys. The industry standard is built to move passkeys app-to-app, not as plaintext files that could be exfiltrated.
He asked the KeePassXC project to “put basic protections in place and collaborate with the ecosystem/industry,” and said attestation would allow RPs (websites) to block it. The pressure was real, but it was a warning about plaintext export, not a plan to lock people in. A plaintext passkey file can be grabbed by malware or talked out of someone by a scammer, which is why the industry built an app-to-app transfer standard instead.
Good to know that they added exporting!
It might make it a bit more acceptable for me, if it’s possible to move the keys to an open password manager.
The initial implementation with the risk of lock-in soured me so much that I just gave up and never looked at it ever again.
I also don’t trust FAANG companies, and them pushing the technology so hard made it an instant turn-off.