Technology

I wish FIDO had paid more attention to SQRL. It's long in the tooth now, but with some attention it could have been a better solution than passkeys, IMO.

I always thought of passkeys as a convenient way to authenticate.

I am password-less on multiple services.

I have an authentication app on my phone that authenticate me when I am away of my computers. I have passkeys on my personal computer and another set of passkeys on my work laptop.

If I have to authenticate from your computer I simply use my auth app, click on "it's a public computer" and I am good to go.

The dude discovered a butter knife and he tries to replace his spoon with it just to realize it doesn't work well for eating a soup.

Passkeys are only good if they aren't in a online password manager. They are better than TOTP 2FA in terms of security and phishing resistance. I see 2FA as a last resort when someone even gets into my password manager. Storing passkeys completely makes this useless, as I'm sure anyone that can log into my accounts would've done so by getting a hold of my unencrypted password manager database. Unless android provides a real offline way of storing passkeys in the device, I am not interested alot.

Why not just passkeys with a “magic link” fallback though?

This is the same as forgotten password so ytf not

If you're using a hardware token to replace passwords, you're doing 2FA wrong