None of the sites I use have suggested they would add passkeys. If passkeys depend on cellphones then I will be excluded from sites that drop passwords and require passkeys. This is probably fine for me personally as it aligns with my goal of dropping sites that I can not quickly reach a human. I only provide my cell phone number to a site if I have a binding contract with them, can reach real humans, are based in the US and I can drive to their HQ in less than 1 day and meet with real people. The bar is even higher if I am to install that companies phone app. I've only ever made one exception to this. Perhaps websites would be happy to exclude my kind.
I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow. Two reasons I believe this: one, passkeys require a shift in user behavior pattern and two, mental model around authentication credentials.
- UX pattern change: no more typing a password can be jarring. Also people equate more friction with better security which passkeys refute as a premise. - Mental model around auth: passwords are shared secrets that are portable across any device. Passkeys inherently are tied to devices. Even synced passkeys are only syncable across devices within an OS ecosystem unless you're using a password manager. A device-associated credential fundamentally breaks the assumption that a user's brain is the "storage location" of their secret. Instead users would have to get used to offloading the "storage" of their secret to their OS's which arguably provides much much much better security but can be hard to wrap your head around.
Password / passkey managers and OS's can ease the adoption woes but it'll take time to dial in the UX for mass adoption. Until mass adoption, passwords will likely continue to exist alongside passkeys.
That excludes me because I disable the TPM on my daily drivers. I leave it enabled on my windows machine that serves a specific purpose but I do not log into anything important on windows.
I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow.
Maybe you are right, I honestly don't know. I just do see me being a part of it. It probably makes sense on my windows machine for the silly things I use it for. I agree that people are opposed to friction and that may drive adoption. I can also see potential for abuse with passkeys by making hardware ID's part of the picture but that is probably a discussion for a couple decades from now including but not limited to decloaking VPN users but those are probably spoilers for another time.