Post by @tay@tech.lgbt

2026-09-08 16:28 UTC

@rmondello@hachyderm.io @leo@60228.dev Yeah - I don't disagree. And I'll assume you've heard all this before, probably by people who claim this is all some big conspiracy by Big Tech or whatever, which I am not going to do. And honestly, I think this is generally me just venting frustration with not being trusted to make my own mistakes, and the greater industry wide concern around power & control, with Passkeys coming about in a time decisions the industry as a whole makes are so often, (often unintentionally) servicing those who wish to seize control from users, and being conveniently useful for those types. I do believe that as those who have the power to craft technology, with its great ability to impact humanity for good & bad, we have a duty to serve greater humanity, and I genuinely can & want to believe that the people behind Passkeys et all genuinely have the best of intentions (and have done great work so far), I don't think we, as programmers have done the best job at critically examining & resisting power structures.

Replies (1)

@tay@tech.lgbt 2026-09-08 16:30

@rmondello@hachyderm.io For example, recently, the US Administration sanctioned the organisation Autistici/Inventati, for "support[ing] the operations of far-left terrorist networks" - I am not going to discuss the validity of that - but, as a result, their primary domain was seized, and due to the implementation of Passkeys taking away that agency from users, served conveniently to enforce the USGov's decision, as, anyone who set up FIDO based authentication found themselves needing to recover their account And of course, yes, requiring account recovery would have been worth it just for the sake of, if it was a phishing site the user went to, would only be given a new (hopefully nowhere-else-used) password. And yes, it would be unreasonable to expect your password manager to magically know that this domain is actually the same as another - but with standard passwords,a user was given the freedom to bypass the 'This is the wrong site' warning and hit 'Fill anyway', or just manually copy and paste their password.

Open ##5098918