On Wednesday, a single sentence from Nikita Bier — X’s Head of Product and the founder behind viral apps like tbh and Gas — lit up Hacker News: “Passkeys were invented by engineers with zero understanding of consumer brain.” The post drew 289 upvotes and 378 comments, a tidy little brushfire of agreement from the technologist class. Bier was saying aloud what plenty of people in software have muttered privately: passkeys are clever, elegant, and utterly baffling to anyone who isn’t an engineer.

He’s not wrong about the friction. He’s just the wrong messenger.

The same week Bier’s critique went viral, the FIDO Alliance released its 2026 State of Passkeys report. The numbers are striking: 90% consumer awareness, 75% of users have enabled passkeys on at least one account, and 68% of organizations are deploying or piloting them for employee authentication. This is not a technology failing to find its audience. It is a technology in the middle of a messy, uneven, but unmistakably real rollout — the kind of transition where the UX complaints are loudest precisely because adoption is crossing from early adopters to everyone else.

The Man Who Could Fix It

Here is what makes Bier’s complaint more than a stray tweet: he runs product at X. X is one of the largest consumer platforms on earth. It implements passkeys. If the passkey experience on X is confusing — if the recovery flow dumps a user into a dead end, if the cross-device handoff feels like a magic trick gone wrong, if the enrollment screen reads like an RFC — that is, in some nontrivial measure, his problem to solve.

The tweet is not a diagnosis. It is an abdication dressed as insight.

Imagine the CFO of a major bank tweeting that mortgage applications are “designed by underwriters with zero understanding of how normal people fill out forms.” You would ask: and what are you doing about it? The bank ships the form. The bank controls the language, the flow, the error handling. The standard — Regulation Z, the uniform residential loan application — sets the guardrails, but the experience belongs to the institution that implements it.

Passkeys work the same way. The WebAuthn standard defines the cryptographic handshake. Everything the user actually sees — the enrollment prompt, the biometric confirmation, the account recovery path, the fallback when a device doesn’t support the protocol — is implementation. It is product work. It is, specifically, the kind of product work that a Head of Product at a consumer platform is paid to do.

What the Numbers Actually Say

The FIDO data complicates the narrative in useful ways. Ninety percent awareness is not a technology nobody understands. Seventy-five percent having enabled at least one passkey is not a feature consumers are rejecting. The friction is real — nobody who has tried to move a passkey from an iPhone to a Windows laptop would call it seamless — but the friction is concentrated in the seams between platforms, not in the core interaction.

One product manager at a midsize bank that rolled out passkeys for its mobile app last quarter described the dynamic in a conference hallway at Money20/20: “Our enrollment completion rate is 82%. The complaints aren’t about creating the passkey. They’re about what happens six months later when someone upgrades their phone and can’t find the recovery option. That’s not a protocol problem. That’s us not building the right recovery surface.”

The distinction matters. A protocol problem — the cryptographic spec is broken, the attestation model is unsound — requires standards-body politics and years of revision. A recovery-surface problem requires a product manager to prioritize it in the next sprint. Conflating the two is how you get viral tweets instead of better software.

The Abdication Economy

There is a pattern here, and it is bigger than passkeys. A certain kind of product leader — often the kind who built their reputation on consumer social apps with short half-lives — has developed a reflexive habit of treating infrastructure standards as immutable forces that happen to them, rather than as substrates they are responsible for shaping.

Bier is unusually visible, but he is not alone. You see the same instinct in the product executive who tweets about how “nobody understands privacy policies” while their own company’s consent flow is a dark-pattern labyrinth. You see it in the engineering lead who gives conference talks about the tragedy of notification overload while their own app sends three push alerts a day begging users to come back.

The move is always the same: identify a genuine user-experience problem, attribute it to a faceless “they” — engineers, standards bodies, the industry — and collect the engagement. What the move never includes is the sentence that would make it honest: “and I am in a position to fix it.”

Passkeys will be fine. The adoption curve is bending in the right direction, and the major platform vendors — Apple, Google, Microsoft — have too much invested in the passwordless transition to let the recovery experience stay broken forever. The more interesting question is whether the product leaders who built careers on viral social apps will learn to do the slower, less glamorous work of making infrastructure feel like it was designed for humans. A tweet is not a strategy. And a Head of Product who treats the product he ships as someone else’s mistake is not leading. He is just posting.

Sources