I run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While bi

I run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While big tech control over passkeys is certainly something that should be watched closely as we move forward, all signs currently are that the system will be relatively open to third party developers, including open source solutions. That said, I have other concerns, especially when it comes to decentralized and self-hosted apps. The main problem is that passkeys don't offer any sort of an identity handle to use for granting access to someone who doesn't already have a passkey registered with your system. For example, if I have a self-hosted photo server, and I want to give a friend access to an album, I can simply grant access to friend@example.com. As long as they can prove they own that email address they can access the album. I'm not aware of any way to do this with passkeys. But big tech won't be equally affected. Google photos for example ties your passkey to your gmail address, so their users still get the convenience of semi-global user search and the extra security of passkeys. IMO we need something more like Mozilla Persona that ties a global identifier such as an email address to a key pair. I'm curious if we could build a protocol around OpenPubkey[1] for this purpose. There may be a way to add this to passkeys but I suspect not given how tightly each passkey is tied to the domain it's created for. [0]: https://lastlogin.io/ https://lastlogin.io/ [1]: https://www.bastionzero.com/openpubkey https://www.bastionzero.com/openpubkey