Comment by Fnoord

Not all TPM. I've yet to manage it on my MBP M1 Pro or my Pixel. Of course, M1-M3 have broken secure enclave which cannot be fixed by the user.

On AMD with fTPM I get a fat warning if I want to reset the fTPM keys. I think earlier implementations failed here.

> and does not bode well for hardware-backed Passkeys that would also be inherently reliant on TPM storage.

So you revoke the key and auth in another way (or you use a backup). One passkey is never meant to be the one sole way of auth.

I actually like the concept. Consider a situation where you would log into your webmail while in a café or bus. If the password is tied to your hardware, nobody can watch over your shoulder to use it on theirs.

I don't use them much (I've been forced to) because I already use a self-hosted password manager where I never see the password myself. But for the average person, passkeys are better.

Now, if you compare with FIDO2, those are supposed to be with you all the time (something you have). So they can be used on multiple platforms, while a TPM is tied to hardware.