They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.
there's some issues with passkeys, but not being able to memorize them is a feature
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
double triple emphasis on "memorized"
place it in a fireproof safe alongside your other important documents, like your passport and birth certificate.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
In that case, they've completely and utterly failed.