4 ms·

So far, no one has commented on this large downside of passkeys: that it will promote the ease of sites to require login since it's much easier to generate a pa

So far, no one has commented on this large downside of passkeys: that it will promote the ease of sites to require login since it's much easier to generate a passkey than to remember a new password or even store it. Thus, passkeys lubricate the path towards an ever-increasing login-based society where it becomes much easier to track and monitor your online behaviour. Although it has the benefit of making our existing lives easier by removing the need to remember our banking passwords, it also will bring us further into the realm of technology by making more and more services log-in based. A greater ease of making a log-in based service means more revenue, more profit for Apple, and a greater integration of technology into our lives. Few people realize this because we have been conditioned to believe that new technology is solely for our benefit. In reality, Apple is not concerned with our benefit. They are concerned with profit and making technology more efficient to accomplish that end. So although passkeys might seem nice, there is a serious downside to this technology.

rickdeckard 3y ago
It's also a convenient workaround to synchronize information about your online-behavior, while still being able to state publicly that your browser-history is never processed to profile you. Upvoting this because it's a view worth sharing (and I'm sure you'll be downvoted just because of your baseless claim that Apple is concerned about something as dirty as profit /s)
- theshrike79 3y ago
  Apple is making filthy amounts of money just from hardware and app sales. All of their attempts at targeted advertising have been rounding errors at best. And they know that complete unbreakable privacy is the place where Google (an ad company) can never ever fully follow no matter what kind of lip service they do in their keynotes about privacy.
  - clairity 3y ago
    all of apple's recent growth is coming from its content ("services") business, which means it's hot to track you for advertising purposes. passkeys provide another stone in their walled garden to be able to track you but keep others from doing so as effectively, which on balance contributes to its competitive advantage. make no mistake that this is the direction apple is headed. it's been clear for the last 5 years or so, since hardware sales have leveled off. perhaps the goggles will dampen the velocity a bit, but i'm very skeptical that the AR/VR market is mature enough to have that effect in the near future.
- arianvanp 3y ago
  Passkeys are stored in your encrypted iCloud keychain. Apple doesn't see or process what websites you're logged into on their servers.
RcouF1uZ4gsC 3y ago
> So far, no one has commented on this large downside of passkeys: that it will promote the ease of sites to require login since it's much easier to generate a passkey than to remember a new password or even store it. Actually, this ease of use may be beneficial to privacy. Sites don’t need user generated/remembered passwords to require a login, they can just use the sign in with Google/Facebook/Apple buttons. Because it is easier than remembering another password, users will typically use those options. Passkeys is more private than signing in with Google/Facebook/Apple, while also providing more privacy than those options.
- vouaobrasil 3y ago
  You are ignoring the other side of the equation: more sites with logins.
  - patmorgan23 3y ago
    Then just create a new login each visit if it's so trivial.
goalieca 3y ago
Each website gets a unique key. They are not signed or rooted in any trust. You can still pick any username you want for the account. What passkeys do is replace OTP and MFA. They live along SSO and do not replace it.
- anderspitman 3y ago
  I think the first use cases of WebAuthn were targeted at MFA, but passkeys are definitely being advertised as replacing passwords as the primary/only factor (with the caveat that you'll also be expected to perform some sort of pin/bio authentication on the local device).
arianvanp 3y ago
How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie wall. They're considered "necessary" processing)
- vouaobrasil 3y ago
  If it is easier to do something, more websites will do it. Passkeys make it easier to make new logins, so more websites will do it. Just like seatbelts make people drive more dangerously. If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encourage more login-based services. You need to step away from the engineering details and look at things sociologically.
  - dan-robertson 3y ago
    Doesn’t Apple Pay make it easier to not log in to websites (by getting rid of their desire to save payment details or addresses to get through later checkouts faster)? I just don’t really see some grand pro-login plan implied by Apple’s actions.
    - vouaobrasil 3y ago
      You are right. Of course, I am not talking about a conscious plan by board members or employees, but the general emergent trend inherent to this type of technology. I did not mean to imply conscious action as we know it.
- cj 3y ago
  With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needing to be cookie-based). Passkeys = quicker and faster to get a user's email address. Email address = even better than "super cookies"
cj 3y ago
> passkeys lubricate the path towards an ever-increasing login-based society where it becomes much easier to track and monitor your online behaviour This trend is already in motion thanks to the deprecation of 3rd party cookies and Apple's restriction of device identifiers, etc, on iOS. For most advertisers these days, the only way to run retargeting campaigns or measure conversions is with 1st party data. That means people are no longer relying on cookies at all for much of their conversion tracking. Instead, email addresses are used. This is (I think) an unintended side effect of stripping away cookies. At least with cookies, you could delete them locally. But now so much tracking is done with first party data, cookies are playing much less of a role. And of course there's not an easy "delete all first party data" button in your browser because the data is (obviously) held outside the browser.
DCKing 3y ago
It's a thought provoking angle you have here for sure. However, am I right that the implication of this direction of thinking is that we should stay with our current ways of doing authentication simply because them being too hard to use puts up a natural barrier? That some of the ways in which they are broken are intrinsically good?
dan-robertson 3y ago
I don’t think this makes sense. Sites already desperately try to get people to log in. I don’t particularly see it as an advantage for Apple if eg the Reddit website or some random online shop makes you log in. If Apple are interested in selling ads, I think they should not want to make it easy to track people on websites through logins as that helps their competitors. I generally model Apple as preferring that you use (and pay for/in) some app rather than a website, and logins are less necessary for apps where you can store information about your session and don’t need to regularly prompt the user for passwords. I think Apple would rather you don’t have some separate account you can log into on a website to eg pay for a service without in-app-purchases. I mostly think of passkeys as a better version of the password manager: allowing users to do what they already want in a more secure way. If there is some subtle business advantage it is maybe that users would make new accounts rather than using sign-in with Google/Facebook, though I don’t know to what extent those features are valuable to Google/Facebook.
UncleMeat 3y ago
"Authentication has to be messy and painful so it isn't adopted" is an odd take. This also seems to be the polar opposite of most complaints about passkeys. The typical response is that they won't replace passwords because passwords are easy and accessible. Here you are saying that passkeys are easier. It can't be both.
danShumway 3y ago
This is not high on my list of concerns about passkeys. I worry about attestation, vendor lock-in, the spec process, etc... but (if attestation isn't a huge issue) easier account creation is not a huge deal because multiple-account creation will also get a lot easier. If a system is requiring your passkey plus a metric to verify your identity (again, assuming attestation doesn't become a problem), then they're already in a position where asking for your email is not a big deal. So I don't see how passkeys change anything for them. On the other hand, any account that would have asked for my email before now doesn't have to. And if attestation goes well and Apple continues rejecting it for roaming providers, they won't get any information other than my login credentials. I have disposable email addresses, but most people don't. Getting rid of a factor that essentially forces them to only have a single account with a service and makes it easier to track them across services -- getting rid of that is a good thing. There's tons to be worried about with passkeys, but this is not something that worries me. What worries me is if attestation pushes its way into the roaming provider implementations and suddenly I can't create an account on a rooted phone anymore. But getting rid of extra verification/identity steps would be good for users and good for privacy. It would be great if I could sign up for a service just with a key and without an email address.
bravetraveler 3y ago
It's a fair point, but I'm not that worried about more logins. We're already being pushed this way by Big Business wanting more and more users to mine/advertise towards. I worry a little about normalizing on fingerprints, but not because tin-foil-hat thinking about tracking. Those can certainly be ordered/forced by a judge, where passwords/codes are less well defined. I'm not up to anything shady, but I fear an authoritarian government. Let's consider PINs, too. Those can be used instead. How many of these are people going to memorize? Many passphrases become one relatively easily guessed number on a device you can lose Implementation details, surely - and I'm really green... but I worry about unintended consequences a lot
patmorgan23 3y ago
If a site requires you to create a login just to view some content, could you just create a new login each time you visit? Also that would probably kill their Google ranking.

rickdeckard 3y ago

It's also a convenient workaround to synchronize information about your online-behavior, while still being able to state publicly that your browser-history is never processed to profile you. Upvoting this because it's a view worth sharing (and I'm sure you'll be downvoted just because of your baseless claim that Apple is concerned about something as dirty as profit /s)

theshrike79 3y ago
Apple is making filthy amounts of money just from hardware and app sales. All of their attempts at targeted advertising have been rounding errors at best. And they know that complete unbreakable privacy is the place where Google (an ad company) can never ever fully follow no matter what kind of lip service they do in their keynotes about privacy.
- clairity 3y ago
  all of apple's recent growth is coming from its content ("services") business, which means it's hot to track you for advertising purposes. passkeys provide another stone in their walled garden to be able to track you but keep others from doing so as effectively, which on balance contributes to its competitive advantage. make no mistake that this is the direction apple is headed. it's been clear for the last 5 years or so, since hardware sales have leveled off. perhaps the goggles will dampen the velocity a bit, but i'm very skeptical that the AR/VR market is mature enough to have that effect in the near future.
arianvanp 3y ago
Passkeys are stored in your encrypted iCloud keychain. Apple doesn't see or process what websites you're logged into on their servers.

RcouF1uZ4gsC 3y ago

> So far, no one has commented on this large downside of passkeys: that it will promote the ease of sites to require login since it's much easier to generate a passkey than to remember a new password or even store it. Actually, this ease of use may be beneficial to privacy. Sites don’t need user generated/remembered passwords to require a login, they can just use the sign in with Google/Facebook/Apple buttons. Because it is easier than remembering another password, users will typically use those options. Passkeys is more private than signing in with Google/Facebook/Apple, while also providing more privacy than those options.

vouaobrasil 3y ago
You are ignoring the other side of the equation: more sites with logins.
- patmorgan23 3y ago
  Then just create a new login each visit if it's so trivial.

goalieca 3y ago

Each website gets a unique key. They are not signed or rooted in any trust. You can still pick any username you want for the account. What passkeys do is replace OTP and MFA. They live along SSO and do not replace it.

anderspitman 3y ago
I think the first use cases of WebAuthn were targeted at MFA, but passkeys are definitely being advertised as replacing passwords as the primary/only factor (with the caveat that you'll also be expected to perform some sort of pin/bio authentication on the local device).

arianvanp 3y ago

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie wall. They're considered "necessary" processing)

vouaobrasil 3y ago
If it is easier to do something, more websites will do it. Passkeys make it easier to make new logins, so more websites will do it. Just like seatbelts make people drive more dangerously. If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encourage more login-based services. You need to step away from the engineering details and look at things sociologically.
- dan-robertson 3y ago
  Doesn’t Apple Pay make it easier to not log in to websites (by getting rid of their desire to save payment details or addresses to get through later checkouts faster)? I just don’t really see some grand pro-login plan implied by Apple’s actions.
  - vouaobrasil 3y ago
    You are right. Of course, I am not talking about a conscious plan by board members or employees, but the general emergent trend inherent to this type of technology. I did not mean to imply conscious action as we know it.
cj 3y ago
With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needing to be cookie-based). Passkeys = quicker and faster to get a user's email address. Email address = even better than "super cookies"

cj 3y ago

> passkeys lubricate the path towards an ever-increasing login-based society where it becomes much easier to track and monitor your online behaviour This trend is already in motion thanks to the deprecation of 3rd party cookies and Apple's restriction of device identifiers, etc, on iOS. For most advertisers these days, the only way to run retargeting campaigns or measure conversions is with 1st party data. That means people are no longer relying on cookies at all for much of their conversion tracking. Instead, email addresses are used. This is (I think) an unintended side effect of stripping away cookies. At least with cookies, you could delete them locally. But now so much tracking is done with first party data, cookies are playing much less of a role. And of course there's not an easy "delete all first party data" button in your browser because the data is (obviously) held outside the browser.

DCKing 3y ago

It's a thought provoking angle you have here for sure. However, am I right that the implication of this direction of thinking is that we should stay with our current ways of doing authentication simply because them being too hard to use puts up a natural barrier? That some of the ways in which they are broken are intrinsically good?

dan-robertson 3y ago

I don’t think this makes sense. Sites already desperately try to get people to log in. I don’t particularly see it as an advantage for Apple if eg the Reddit website or some random online shop makes you log in. If Apple are interested in selling ads, I think they should not want to make it easy to track people on websites through logins as that helps their competitors. I generally model Apple as preferring that you use (and pay for/in) some app rather than a website, and logins are less necessary for apps where you can store information about your session and don’t need to regularly prompt the user for passwords. I think Apple would rather you don’t have some separate account you can log into on a website to eg pay for a service without in-app-purchases. I mostly think of passkeys as a better version of the password manager: allowing users to do what they already want in a more secure way. If there is some subtle business advantage it is maybe that users would make new accounts rather than using sign-in with Google/Facebook, though I don’t know to what extent those features are valuable to Google/Facebook.

UncleMeat 3y ago

"Authentication has to be messy and painful so it isn't adopted" is an odd take. This also seems to be the polar opposite of most complaints about passkeys. The typical response is that they won't replace passwords because passwords are easy and accessible. Here you are saying that passkeys are easier. It can't be both.

danShumway 3y ago

This is not high on my list of concerns about passkeys. I worry about attestation, vendor lock-in, the spec process, etc... but (if attestation isn't a huge issue) easier account creation is not a huge deal because multiple-account creation will also get a lot easier. If a system is requiring your passkey plus a metric to verify your identity (again, assuming attestation doesn't become a problem), then they're already in a position where asking for your email is not a big deal. So I don't see how passkeys change anything for them. On the other hand, any account that would have asked for my email before now doesn't have to. And if attestation goes well and Apple continues rejecting it for roaming providers, they won't get any information other than my login credentials. I have disposable email addresses, but most people don't. Getting rid of a factor that essentially forces them to only have a single account with a service and makes it easier to track them across services -- getting rid of that is a good thing. There's tons to be worried about with passkeys, but this is not something that worries me. What worries me is if attestation pushes its way into the roaming provider implementations and suddenly I can't create an account on a rooted phone anymore. But getting rid of extra verification/identity steps would be good for users and good for privacy. It would be great if I could sign up for a service just with a key and without an email address.

bravetraveler 3y ago

It's a fair point, but I'm not that worried about more logins. We're already being pushed this way by Big Business wanting more and more users to mine/advertise towards. I worry a little about normalizing on fingerprints, but not because tin-foil-hat thinking about tracking. Those can certainly be ordered/forced by a judge, where passwords/codes are less well defined. I'm not up to anything shady, but I fear an authoritarian government. Let's consider PINs, too. Those can be used instead. How many of these are people going to memorize? Many passphrases become one relatively easily guessed number on a device you can lose Implementation details, surely - and I'm really green... but I worry about unintended consequences a lot

patmorgan23 3y ago

If a site requires you to create a login just to view some content, could you just create a new login each time you visit? Also that would probably kill their Google ranking.