A viral tweet blamed passkeys on engineers. The replies blamed Big Tech's device lock-in instead

The tweet: passkeys failed because engineers don't think like normal people

Nikita Bier's tweet argued that passkeys — the passwordless login standard backed by Apple, Google, and Microsoft — never achieved mass adoption because the engineers who designed them optimized for cryptographic elegance over how an average person actually behaves online: they don't understand device-bound credentials, they panic when they can't "remember" a password, and they abandon any flow that doesn't feel familiar. It's a UX critique, and on Hacker News it triggered 641 comments — not mostly about UX.

One real-world data point arrived mid-thread: a reader reported that Microsoft had just emailed their organization's tenant admins that SMS and voice 2FA are being retired February 2027, with automatic passkey enrollment starting September 2026. Passkeys aren't staying optional for much longer, which raised the stakes on every complaint that followed.

The security case against passkeys nobody puts in the marketing copy

The sharpest reversal came from an engineer working in computer security, who reframed the entire debate: the problem with passkeys isn't onboarding friction, it's that they're "a vector for locking your logins to Big Tech ecosystems." The mechanism is device attestation — a feature in the passkey spec that lets a service demand proof you're using an approved passkey client, not just any spec-compliant one. The passkey standards body maintains an actual list of "known issues" flagging non-compliant clients — in practice, alternative password managers and self-hosted implementations that don't play by Big Tech's rules. A service can cite that list to justify blocking anything that isn't Google, Apple, or Microsoft's own app, all in the name of "security." Their conclusion: "Until device attestation is removed or strongly curtailed in the spec, I suggest you do not create any Passkeys. Which sucks, because it's otherwise a pretty cool tech."

A second voice reframed the entire technology as nothing new: "Passkeys are just SSH keys in how they work," they wrote. "We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting." Their point cuts against both the tweet and the security critique at once — the core cryptography isn't new or hard to explain, and it's already had thirty years to become mainstream, and hasn't. Layering a slicker UI on an old idea doesn't fix why the old idea stayed niche.

A darker read, and a genuinely open question

One reply pushed the skepticism into surveillance territory: keeping credentials "always-online and connected to the major providers" makes them easier for intelligence services to access via backdoors already built into Big Tech infrastructure — speculative, framed by its own author as a "tinfoil hat take," but it landed because device attestation gives the theory a concrete mechanism to point at rather than pure paranoia.

And one question went unanswered for the rest of the thread, half-joking but pointing at where all of this is actually headed: "How is one supposed to let an LLM log in with passkey?" As agentic AI tools start acting on users' behalf across the web, a credential system explicitly designed to bind to one physical device and one approved client stops being just a UX problem — it becomes an architecture problem nobody in the passkey spec meetings was solving for.