nonfunctional

If that's really what it is, Google should put their money where their mouth is. I'd be ok with this change if you had to go through all the same hoops to install apps through the Play store.

Note that YubiKeys are not passkeys. But they are a great alternative to passkeys that are just as secure if not moreso.

You're right, I didn't explain in much detail the motivation that will push websites to start requiring the remote attestation flag to be set. I will try to cover that in a future article.

But as for how it could "catch" you: if you use FOSS devices that are unattestable (as is the case for the LineageOS phone and Linux laptop I exclusively use), you may one day find you can't use many websites.

If you also support TOTP and physical security keys as an alternative to passkeys, that should be enough to provide a stable long-term alternative for users of FOSS devices. And of course, RP-side you can choose to never require the remote attestation flag to be set.

Convenience is precisely the thing that big tech established tech platforms want to reward their users with to keep them around. The undeniable convenience of passkeys didn't have to come with a standard that is threatening against unattestable devices like my Linux phone. But it does, and that means passkeys are a way that the industry can discourage people away from using non-Google/Apple/Microsoft-approved devices.

The intended audience is people who are not yet using passkeys, or have just started (due to all the websites demanding them now) but don't really know what they are.

I apologize that the headline is provocative. I thought for a long time about how to appeal to both people who are barely aware of what passkeys are but also not put off people who like them. I considered calling them a "Trojan Horse" in the headline as I do in the body (i.e. legitimately lovely, but with a terrible and unobvious problem) but "trojan" has another connotation in computer security.

Nonetheless, I said what I meant. Convenience is how they get you. This convenience didn't have to come with a trap, but thanks to the way it was designed, it does.

My understanding is that TOTP and physical security keys both share very little information about you. Perhaps passkeys, being part of a standard that the FIDO Alliance keeps updating, may some day be expected to reveal considerably more information. And the limited number of remote-attestation-approved passkey managers might someday all start start volunteering such information regardless.

I completely agree that KeePassXC and other password managers give you total user control, and they do support "passkeys" -- but crucially, not all kinds of passkeys. KeePassXC has no remote attestation support, nor hardware-backing support, and nor do I think it should.

My claim is not that passkeys couldn't give you control in principle. It's that the standard readily allows for websites to prevent you from being allowed to exercise that control, and the unclear messaging and UX around passkeys means most users will not even notice should this happen.