Ret on Nostr: Lots of passkey debate again. Look. I’ll lay it out nice and simple: I hate them ...
Lots of passkey debate again.
Look. I’ll lay it out nice and simple: I hate them because you keep asking me to use them. I purposely seek out 2FA options when I make a new account somewhere because it’s generally just a “hey, we offer 2FA if you wanna turn it on to keep your account safer”.
eBay asks me EVERY FUCKING TIME I LOG IN to make a passkey. It triggers the browser API to open the annoying fucking UI to do it. It’s a “Ask me Later” not a “Never Ask Again”. Most sites that support passkeys are like this. A few sites I’ve inadvertently ended up with a passkey because of how pervasive the dark patterns are around them.
Fuck off. I don’t want to use them. I don’t trust them. I don’t like the concept of them. They’re opaque and contain a ton of data I don’t know about. Flags that will be used to control my capabilities. Information about my mechanism for storing them that I don’t necessarily want to share with all sites.
When you push something very hard like this, you inherently seem untrustworthy.
Published at
2026-10-15 22:33:30 UTCEvent JSON
{
"id": "c43521de3b041aeb5c7428a6e1e5cf57cadd10fb2daa4895ddfac1a660994398",
"pubkey": "6f70b41fe4dfa97a784b9eb631184c73f3760326a9ae3da143c9a2ff4abaf30f",
"created_at": 1792103610,
"kind": 1,
"tags": [
[
"proxy",
"https://furry.engineer/@ret/117447302200724599",
"web"
],
[
"proxy",
"https://furry.engineer/users/ret/statuses/117447302200724599",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://furry.engineer/users/ret/statuses/117447302200724599",
"pink.momostr"
],
[
"-"
]
],
"content": "Lots of passkey debate again. \n\nLook. I’ll lay it out nice and simple: I hate them because you keep asking me to use them. I purposely seek out 2FA options when I make a new account somewhere because it’s generally just a “hey, we offer 2FA if you wanna turn it on to keep your account safer”. \n\neBay asks me EVERY FUCKING TIME I LOG IN to make a passkey. It triggers the browser API to open the annoying fucking UI to do it. It’s a “Ask me Later” not a “Never Ask Again”. Most sites that support passkeys are like this. A few sites I’ve inadvertently ended up with a passkey because of how pervasive the dark patterns are around them.\n\nFuck off. I don’t want to use them. I don’t trust them. I don’t like the concept of them. They’re opaque and contain a ton of data I don’t know about. Flags that will be used to control my capabilities. Information about my mechanism for storing them that I don’t necessarily want to share with all sites.\n\nWhen you push something very hard like this, you inherently seem untrustworthy.",
"sig": "4d54ae2fb8c7ac3dc3a06fa1928f443412c38198de9f657c42d65c4857fb8b909331346cc7786e3fb8e3f71b4b35ce25e7b1495631992a8354c59b507bb1e38c"
}