The article is wrong: users copy passwords from their password manager into the website if the autofill doesn't work => phishing. Can't do this with passkeys.
Agree with your other points, the whole passkey story is undeveloped and unclear yet.
Agree with your other points, the whole passkey story is undeveloped and unclear yet.
There are also times when companies change their URL. Or their app using a different URL for their auth API than the website URL. If it’s obvious, the new URL can be added to the password manager to fix this. If it’s an API the user can’t see, this is much more difficult, especially if using a 3rd party password manager, it’s basically impossible. The only thing that made me aware of this, was when Apple introduced their password management and I could see all the login data if saved from various app. All kinds of URLs that were otherwise invisible to me.
What happens to a passkey in this case? Make a new account, start over?