Who controls your identity: passkeys and fingerprinting
"Passkeys are a trap" argues that unlike any other credential, you don't have ultimate control over your passkeys. Commenters pushed back with workarounds: use a real password manager like KeePassXC, and treat passkeys as "cattle, not pets" by registering more than one per account. Another asked why web authentication isn't just a simple HTTP 401 handshake.
In "Fingerprints are the new cookies," the reaction was "cool tech, horrifying invasion of privacy." One company weighed fingerprint.com but settled on JA3/JA4 TLS fingerprinting. An EU-minded commenter pointed out that tracking like this is already illegal there, since the consent banners were always about tracking, not cookies.
The through-line: both stories are about who holds the keys. Passkeys move the credential into a platform vendor's vault. Fingerprinting lets sites identify you with no credential at all.
So what?
If you ship auth, plan for passkeys but always keep a recovery path that doesn't depend on one vendor's ecosystem. If your growth stack leans on fingerprinting, you're taking on regulatory risk in the EU and reputational risk everywhere. Privacy-respecting defaults are becoming a selling point.