Hate Passwords? It’s Time to Try Passkeys

Passkeys are often marketed as a replacement for password + MFA, but I don’t understand how users are protected from malicious passkey resets.

Suppose I’m signed up to a service with a password and TOTP, and my email account gets compromised or the attacker uses social engineering to change the email address on the account. They initiate a password reset, but the TOTP either prevents them from doing so or prevents access after the password is reset.

Now let’s say I use a passkey instead. I guess the reset flow is the same - initiate a reset with the service using email address, then the passkey can be regenerated. Now the attacker has access to my account. There’s no second factor to protect me, because it was baked into the passkey that has now been replaced.

This scenario seems less secure to me. So what’s the solution? Continue to use other methods of MFA with passkeys, such as TOTP/hardware keys etc?

I get passkeys increase security for the average person who reuses passwords and doesn’t use MFA, but for advanced users who already use complex random passwords and MFA, passkeys seem to offer little additional security, but they do reduce convenience (eg, logging into a service on an untrusted device becomes painful).

I’ll continue to use passwords for as long as I can.