Hacker News Reader

Passkeys are more than good enough. Software keys are indistinguishable from hardware keys in the context of credential phishing. Both kinds of keys have the same weaknesses, too, e.g. OAuth phishing (keys do nothing) and DNS hijacking (keys degrade to the same security value as OTP).

Other threat models (malware, physical access) are a different story, of course.

A Pi Pico is around $3, you could see if there are any solutions out there that can turn it into a security key. (though at that point, perhaps just wait for KeePassXC FIDO/U2F support)

I'll look into that, thanks!

Especially when they have a phone that is secured well enough. As long as the EU can keep itself from meddling away the security in their special well intended way, of course.