"Better things aren't possible" is a terrible outlook. There have been real improvements in this space, such as passkeys, and recognition that some of this stuff, like frequent password changes, is counterproductive.
Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.
They also have 2fa built in. No need for a separate app, entering codes whatever.
Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC.
If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't matter.
How do you sync passkeys to someone else's phone to authorize them to act in your name?
This is the basic use case, very common in the physical world, that security industry refuses to accept exists.
Passwords have this capability by nature.
> because most services don't allow you to enroll more than one passkey
Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.
> Well that's why they can sync between devices.
Not sure if either works on iOS, I don't use that but they work on desktop and Android (you use KeepassDX there to read them).
Passkeys are not an improvement. The way they're being implemented entrenches middlemen into auth flows in a way that reduces users' security in a broader sense, while being just as susceptible to compromise as any other form of credential.
Literally no one in security thinks this.