[Digital Today reporter Choi Jae-won (최재원)] Passkeys, seen as a next-generation login technology to replace passwords, could in the long term limit users' choice of devices and software, concerns have been raised. Critics say authentication functions meant to strengthen security could be used by companies as a means of controlling users.

Gigazine, a Japanese media outlet, reported on Oct. 13 that The Hack, a writer for the technology blog Non-Functional, warned of potential user lock-in problems while acknowledging the security and convenience of passkeys.

Passkeys allow users to log in with fingerprint or facial recognition, or a PIN, instead of a password. Websites store a public key and users' devices keep a private key. Because the private key is not transmitted outside during login, passkeys are resilient to password leaks and phishing attacks.

At the center of the controversy is attestation. The feature verifies the manufacturer and type of the authentication device that created the passkey. A web service can use it to allow only passkeys created on devices from specific manufacturers or of specific types.

The Hack argued, "If such restrictions spread, users who use operating systems or software not approved by companies could be excluded from services."

Such restrictions have not become widespread in passkeys for general users. Synced passkeys from Apple and Google do not support attestation that proves the provenance of the authentication device.

By contrast, Microsoft (MS) enterprise service Entra ID provides a feature that allows administrators to restrict the types of authentication devices.

Counterarguments have also been raised. Overseas technology community Hacker News said attestation is information fundamentally required at the passkey registration stage, and that it is not possible to retroactively require the same proof for passkeys already registered.

Others also argued that companies can restrict usage environments through separate authentication policies even without passkeys.

The debate focuses less on security flaws in passkeys themselves than on concerns over user choice that could arise if control over managing authentication technology is concentrated in companies.