My view with passkeys was basically that they force the use of a password manager (even if that manager is mostly invisible to the user). The password manager is something you have and you unlock it with something you know or something you are (biometrics).

That said, I don’t like them. I don’t really understand what happens when I run into edge cases, and that makes me nervous. That’s also true for 2FA in many cases.

So far my only passkey is for Amazon, I felt tricked into it, which I’m not happy about, though my password also still works. I’m opposed to this about as much as forced 2FA. I understand the security aspect, it Gmail randomly started to use their mobile app for 2FA, and now I’m afraid if I delete the app from my phone I’ll be locked out of my account, with the potential for excessive hoop jumping to get it back.

I read an article a while ago with the ultimately conclusion that passkeys don’t offer a major benefit to people who already use long, complex, unique passwords in a password manager. If this is the case, it seems this whole push is designed for people with terrible password habits, who definitely don’t understand what’s going on with passkeys, and I expect will find out once they hit an edge case and end up in a bad spot.