Passkeys
Sep 30, 26
There is no reason for a service built today to authenticate anyone by email.
For the service, email means delivery infrastructure, SPF, DKIM, DMARC, bounce handling, sender reputation, templates, confirmation links, address changes and password recovery.
For the user, confirmation means opening a mailbox and waiting. Passwords are either reused across services or stored in a password manager — a less secure, less convenient alternative to passkeys.
The truth
Services accept the inconvenience, for themselves and their users, for two reasons:
- Send you spam
- Sell your data
That second use is the business of data management platforms, which I unfortunately have experience developing. An email joins your account to advertising identifiers. Registering with one is volunteering to be marked, across the web, as a cohort interested in the service the site provides.
It should be illegal
Requiring an email to register is one of the very few things I hope to see regulated. If the service works without my address, demanding it as the price of admission is blackmail.
Every such service should be obliged to offer an anonymous alternative. Permission to use a service should not cost permission to follow me outside it.
Passkeys
Passkeys are safer than passwords, easier to use, and can’t be stolen or forgotten.