Passkeys
AssessTechniques
Phishing-resistant authentication credentials based on public-key cryptography.
Why it's here
Placed in Assess: 5 article(s) of evidence from 3 source(s), led by security coverage, with 2 in the last 30 days. Confidence 60%.
Evidence (5)
- 4Hacker News·10/11/2026securityPasskeys criticized as a flawed authentication approach
The article argues that passkeys create new usability, recovery, and lock-in problems that can outweigh their security benefits for some users. It frames passkeys as a poor default and encourages caution before adopting them broadly.
- 4Hacker News·9/18/2026securityCritique of passkeys as a login default
The article argues that passkeys improve resistance to phishing and server-side breaches, but can increase the risk of account lockout, device-loss problems, and dependence on weak recovery methods. It also notes practical friction around hardware keys, synced passkeys from Apple and Google, and inconsistent third-party password manager support.
- 7InfoQ·8/18/2026framework_update.NET 11 Preview 7 Adds MAUI Passkeys and Faster XAML Hot Reload
Microsoft's .NET 11 Preview 7 introduces several .NET MAUI improvements, including cross-platform passkey authentication, incremental XAML Hot Reload, Shell route templates, and additional AOT-safe bindings. The release also continues the shift from legacy renderers to handlers and improves Android and Apple development workflows.
- 2Hacker News·7/22/2026securityPasskeys criticized as confusing for consumers
The post argues that passkeys were designed without enough consideration for how consumers understand and adopt new login methods. It highlights confusion among users who are already familiar with passwords and are unsure what a passkey is or how it works.
- 7The New Stack·7/17/2026product_launch1Password adds zero-exposure browser integration for Claude
1Password has launched a browser integration for Claude that lets AI agents sign in without exposing passwords or one-time codes to the model. Credentials are decrypted locally on the user's Mac, injected directly into the website, and access is limited to the specific task the user approves. The feature also adds a separate authorization step and keeps prompt-injection risks in mind, while support for passkeys and payments is planned.