they can already force your to install their app to receive a push notification (cough… google…cough…). if they really want to lock you in they will. passkey or not.

Oct0ber2026!

every single argument I’ve seen against passkeys could be said against TOTP and 2FA in general.

• SMS token: they need to know your phone number. it’s a privacy issue. also actual lock in to one device.
• MS authenticator with push notifications: actual lock in to a single app
• TOTP: you need a manager to store it, way more phishable than passkeys

and yes, you could use third part TOTP managers, but as you said, the average user wont. I dont feel any argument against passkeys is particularly strong.

not sure about every OS but the ios password app has a menu button to export them to other apps. I have exported mine to my own self hosted vaultwarden. took 2 minutes

passkeys are more phishing resistant than passwords, even with password managers

passkeys can perfectly be used with third party password managers. everything you say here can apply to passwords if you use the Os provided manager.

you can absolutely have 2fa with passkeys. most platforms don’t do it since it adds little value

element. based on matrix

getting licensed as an electrician has been on my mind recently. i’m so tired of the whole industry