CJP: For the sake of preserving some measure of privacy and control over your digital life, as well as facilitating account access by your trusted agents, attorneys-in-fact and/or estate administrators upon your death, consider REJECTING “passkeys” in favor of Time-Based One-Time Passwords (TOTP), which can be shared along with your main password. That being said, you should be using a locally-hosted and encrypted (e.g. Proton Pass) strong password generator and manager to augment your use of authenticator apps, while keeping a hard copy, handwritten backup of your passwords under lock and key. Send me a message if you would like a PDF template for A-Z pages that can be Xeroxed, hole punched and kept in a binder. Now, about those “passkeys”:
“There is ample reason for you to be hesitant before you set up a passkey. If you’ve used only websites that require one certain kind of passkey then you might not notice when a website has you set up a different kind of passkey. Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details. They’ll offer you at most a ‘confirm’ prompt. (That’s the convenience aspect.) My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).
“So far, almost nobody has even heard of remote attestation. The vast majority of people use one of the four major operating systems (Windows, Android, macOS, and iOS) and not alternative operating systems like Linux, LineageOS, postmarketOS, or GrapheneOS. The overwhelming majority of people don’t replace the operating system on their phone when it stops receiving updates; instead they just buy a new phone. So almost nobody will ever encounter a situation where their device fails a remote attestation check.
“Are attested passkeys so bad, though? After all, we really aren’t meant be sharing Netflix accounts to begin with.
“Take another look at the list of members in the FIDO Alliance, and put on your tinfoil hat. Why do intelligence agencies care if I am sharing my Netflix account? Heck, why does Microsoft care if I am sharing my Netflix account?
“For intelligence agencies, and for corporations like Microsoft, Google, Apple, Facebook, Amazon – giving you convenience and security is likely not their primary goal. I think they have an entirely ulterior motive. They can use passkeys to prevent you from running unapproved software.”
(Continued, with extensive further discussion)
● “Passkeys are a trap. Do not use them,” The Hack (Substack), 10/10/26:
#privacy #passwords #digitalassets #EstatePlanning #WillandTrust #Inheritance #FinancialPlanning #EstateAttorney #LivingWill #FamilyTrust #AssetProtection #Beneficiary #PowerOfAttorney #LegacyPlanning #AdvanceDirective #InheritancePlanning #LifePlanning #LegalDocuments