Security Warning: The Risks of Using Passkeys for Data Encryption

Summary

The article warns against using passkeys for data encryption, arguing that overloading authentication credentials for encryption creates a dangerous single point of failure. The author expresses deep concern about organizations using passkeys with PRF (Pseudo-Random Function) extensions to derive encryption keys for user data, particularly for end-to-end encryption and backups. The core argument is that this practice creates a 'dangerous blast radius' where losing authentication credentials could lead to irreversible loss of users' most important data like memories and documents.