Passkeys for Passwords

Seems like they're more for the "phishable" and the duplicate password users and obviously the no-password folks.

Seems like its no different from using TouchID as the biometrics to rapidly unlock a vault or account since it stores the real key in the Secure Enclave or whatever and passes it on successfull authentication. Just worse because its probably a randomly generated arbitrary string of numbers and letters that you can't remember at all in case you lose access to them/the device.

In authentication, we usually look for the following factors to verify the user identity `something I know, something I have, something I am.` In passkey, theoretically, you verify all the factors at once. This user has the phone, and the biometrics said, `something I have.` The `something I know` was verified once to create a continuous of the other factors. If you lose your phone, you need to find an alternative way to verify the other factors, which can be done by various methods that each authentication provider has.