> In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security.
They do provide extra security, in that they ensure that you're on the correct domain instead of a phishing site.
They do provide extra security, in that they ensure that you're on the correct domain instead of a phishing site.
Additionally, “the kind of person who's prone to non-targeted phishing attacks” is actually everyone — including infosec professionals spending lots of time on phishing campaigns for red team engagements. You just need to be lucky enough to reach them at the right (emotional, stressful, …) moment. Getting grammar and spelling correct and even potentially even slightly customising each email is made much easier by AI. Knowledgeable users might, however, stop once their passkey doesn’t work and try to understand why.