Sep 8, 2026, 2:24 PM@tay @rmondello there's nothing stopping you from transferring to an app that uses a file-backed database (like Strongbox which is recommended on the KeePassXC site as a compatible iOS client)
- Sep 8, 2026, 2:24 PM
Replies
Ricky Mondellormondello@hachyderm.ioSep 8, 2026, 3:15 PM
Sep 8, 2026, 4:28 PM@rmondello @leo Yeah - I don't disagree. And I'll assume you've heard all this before, probably by people who claim this is all some big conspiracy by Big Tech or whatever, which I am not going to do.
And honestly, I think this is generally me just venting frustration with not being trusted to make my own mistakes, and the greater industry wide concern around power & control, with Passkeys coming about in a time decisions the industry as a whole makes are so often, (often unintentionally) servicing those who wish to seize control from users, and being conveniently useful for those types.
I do believe that as those who have the power to craft technology, with its great ability to impact humanity for good & bad, we have a duty to serve greater humanity, and I genuinely can & want to believe that the people behind Passkeys et all genuinely have the best of intentions (and have done great work so far), I don't think we, as programmers have done the best job at critically examining & resisting power structures.
- Sep 8, 2026, 4:30 PM
@rmondello
For example, recently, the US Administration sanctioned the organisation Autistici/Inventati, for "support[ing] the operations of far-left terrorist networks" - I am not going to discuss the validity of that - but, as a result, their primary domain was seized, and due to the implementation of Passkeys taking away that agency from users, served conveniently to enforce the USGov's decision, as, anyone who set up FIDO based authentication found themselves needing to recover their accountAnd of course, yes, requiring account recovery would have been worth it just for the sake of, if it was a phishing site the user went to, would only be given a new (hopefully nowhere-else-used) password.
And yes, it would be unreasonable to expect your password manager to magically know that this domain is actually the same as another - but with standard passwords,a user was given the freedom to bypass the 'This is the wrong site' warning and hit 'Fill anyway', or just manually copy and paste their password.
- Sep 8, 2026, 4:33 PM
@rmondello For another example, it used to be common for a website or app to ask for your password for a different site. Of course, I am not going to frame this if it was a good idea, but even now - if an OAuth API is not provided or not sufficient for what a user wants to achieve, acting as the user with their credentials, is literally the only option to make the computer act in the user's favour, but because this is also the way genuinely malicious actors interact with a service, it's easy to lump together all this kind of adversarial behaviour into 'malicious' or 'fraudulent'. And of course, Netflix aren't too happy about user's sharing their password, but I don't think it should be the job of my password manager to protect Netflix' business model.
And, another thing given the whole Recent Current Event Cycle: I can't backup my 1P vault with Passkeys, so if 1P (or the friend who's family plan I leech off, or the company they work for who provide said plan) suddenly close my account - I'm SOL.
- Sep 8, 2026, 4:36 PM
@rmondello I understand I'm probably asking a lot for you to even read my wall of text (I could probably have summarised this a lot better than I have) and like. Thinking about this can be very draining (trust me this line of thinking is most definitely not helping my burn out), I don't say all this to be a hater or devalue the work done by the people at FIDO, or anywhere - even with its current flaws it's a great option that I do with I could champion more
but god. I kinda hate the hole we've dug ourself, and I wish we all (ie. everyone who builds software for a company) were willing to be a bit more proactive in trying to prevent that