It's tied to vendor lock in. Which increases the ability of companies who develop certain technologies for the masses to increase the friction of interacting with things outside of the ecosystem. The argument is that if a user is unable to use an alternative, by hook or crook they will pay increasingly high subscriptions to access the services provided by that ecosystem. This increases a number on a spreadsheet, the only true compelling argument one could say

If you're referring to the inability to transfer passkeys across systems, that should be improving soon.

https://blog.1password.com/fido-alliance-import-export-passk...

https://arstechnica.com/security/2025/06/apple-previews-new-...

[0] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Then _soon_ I might reconsider using passkeys.

I'm not making changes to my security workflows now based on promises that the lock-in potential will be reduced as some unspecific point in the future.

> - I want to be able to share passwords for accounts with my family (some, but not all of them)

This, but for another reason. To all those "I can do this with Keepass/Bitwarden etc", how can you share your Netflix password with your parents 100 miles away to use it in their smart TV? You cannot and will never be able to do it. Yes, passkeys improve security in some contexts but also tighten the grip of service providers.

I doubt streaming services are looking to make passkeys the only way to authenticate devices though. Too much competition, and too many valid use cases for use outside of a personal device.

Like the millions of "terms of use" breached by the exact trillion dollar companies pushing for passkeys (Google, Microsoft) while training their AI models? Sounds like terms of use are entirely irrelevant in the first place.

Then see what happens if meta downloads an entire library and trains their AI with it.

Meta just figured the fine is worth the leap ahead in AI training, and I kind of agree.

Since when "you are not supposed to do it" works? :) Most videogames cannot be freely copied or modified/tampered with, according to their ToS; still, companies implement draconian DRMs/anticheat to block people from doing it anyway. This is the same situation.

I mean, it was an example. Replace it with an amazon account and the argument remains the same.

I'm not sure that's a good example. I thought you currently only need to share your password if you want to let them use your Netflix account on their computer/phone/tablet. If you are just trying to set them up on their smart TV wouldn't you simply have them install the Netflix app on their smart TV, launch it, hit sign in, and then tell you the 8 digit confirmation code from the app, and then you would go to netflix.com/tv2 on your computer/phone/tablet, enter that code, and use your credentials to confirm?

So let's change it to you want to let your parents use your Netflix on their computer/phone/tablet. Netflix doesn't currently support passkeys, but we will assume they will at some point.

What you would do is something like this.

1. Tell them your Netflix account name.

2. Have them go through Netflix's procedure for logging in on a device that does not have a passkey when you have no other devices available that do have a Netflix passkey for your account. They are almost certain to have some way to do this.

3. One they are logged in they can add a Netflix passkey to that device.

https://learn.microsoft.com/en-us/windows/apps/develop/secur... https://blogs.windows.com/windows-insider/2025/06/27/announc...

But one of the selling point is that they are supposed to help bog standard users be more secure. How many bog standard users do you see using a good password manager, despite how long we've been suggesting that they do. If they aren't going to use one for passwords they aren't going to use one to smooth the edges of passkeys use.

No you don't, you want to share access, and the only way you can do it with passwords is by sharing the password itself. With passkeys you can have each person register their own passkey.

Do all using services allow this? Is it at least ad easy and straightforward as telling your trustworthy auntie your password?

I'm pretty sure I have my Android phone setup with a passkey for my Google account and also my Windows laptop.

Presuambly the same logic applies for a service that permits multiple passkeys. Each person would register a passkey on their device using the shared credential.

There in lies the issue. With passwords, it doesn't matter if the account supports multiple passwords. I can share the one I have

> Presuambly the same logic applies for a service that permits multiple passkeys. Each person would register a passkey on their device using the shared credential.

but can I simply share the passkeys without someone's permission (other than my own)?

Plus that doesn't really address allowing someone else in your family to log into your account "temporarily"; ie if you want them to check something for you.

The built in password manager in iOS/MacOS also supports synchronizing passkeys across devices (via iCloud), and again, i'm not sure if you can share those passkeys between uses, but same argument as for 1password.

I’m a 1Password user. There are times I want to login with one of my personal accounts on my work laptop, auxiliary device I have, or family member’s device. On all these occasions, I’m not going to install 1Password and sync down my entire vault, just to delete it 5 minutes later. I simply reveal the password in my app and type it in. With passkeys there is no way to do this. It’s an edge case, but an important one.

I’d feel much better about passkeys if it wasn’t some mysterious thing locked away in a vault. If it’s effectively a public/private key pair, I should be able to see the private in my password manager and copy/paste it wherever I want, and however I want. If I could do this I would instantly understand what’s going on and be more accepting of it, though I’d expect I’d still run into some edge cases.

After entering your username, you select an option to use your other device to sign in and scan a QR code with it.

Are passkeys ubiquitous? It doesn’t feel that way. Tech demos are nice, but they’re just tech demos. When I’m doing my taxes I don’t want to find out I can’t download my data in TurboTax because I can’t login to my bank with a passkey via their app. Or maybe I want to use some old hardware, where the apps haven’t been updated with QR codes and passkeys, I guess I’m out of luck.

Too many edge cases. They are trying to sell passkeys as a magic way to login. I’m not going to entrust my ability to login to magic.

Also, scanning QR codes to authenticate feels very janky. Isn’t that why CurrentC failed? No one wanted to do a QR code dance with their phone.