Because it prevents an attacker from stealing the password. It's both extremely hard to "steal" a passkey, and to phish a login from one. Neither of those are true for passwords, and TOTP only partially solves the stealing part.
Passkeys aren't solving for security nerds who like portability and have 30 character long passwords, they're solving for grandpa who will happily read their bank's 2FA SMS to the "bank" over the phone. The FIDO alliance has literally billions more of these users than they do users who know what hardware attestation is and how it impacts their auth workflows.
The security requirements are generally hidden from users. I have never noticed different behaviour between my passkeys.
But as I said, there are plenty of UX issues with passkeys, those UX issues however don't include getting your accounts hacked, phished, passwords lost in data breaches, etc, which I'd suggest are a lot worse.
We don't need attestation and most of the data bits. Apple consumer devices don't support attestation. Only Apple enterprise managed devices do. It's a paranoia tool for big enterprises with strict device management requirements. Apple has a lot of good reasons to believe attestation is a privacy violation for consumers and seems likely to keep up the good fight in making sure it remains an enterprise-only tool.
So companies can use passkeys and set policies around what hardware they're stored on. IMHO, not particularly useful or desirable for everyday Internet users, but really nice if you have specific requirements.
Because it prevents an attacker from stealing the password. It's both extremely hard to "steal" a passkey, and to phish a login from one. Neither of those are true for passwords, and TOTP only partially solves the stealing part.
Passkeys aren't solving for security nerds who like portability and have 30 character long passwords, they're solving for grandpa who will happily read their bank's 2FA SMS to the "bank" over the phone. The FIDO alliance has literally billions more of these users than they do users who know what hardware attestation is and how it impacts their auth workflows.
This level of security is perfectly achievable with an unattested passkey.
And Grandpa will have fun if he has to juggle 20 passkeys with different security requirements on his devices.
The security requirements are generally hidden from users. I have never noticed different behaviour between my passkeys.
But as I said, there are plenty of UX issues with passkeys, those UX issues however don't include getting your accounts hacked, phished, passwords lost in data breaches, etc, which I'd suggest are a lot worse.
We don't need attestation and most of the data bits. Apple consumer devices don't support attestation. Only Apple enterprise managed devices do. It's a paranoia tool for big enterprises with strict device management requirements. Apple has a lot of good reasons to believe attestation is a privacy violation for consumers and seems likely to keep up the good fight in making sure it remains an enterprise-only tool.
So companies can use passkeys and set policies around what hardware they're stored on. IMHO, not particularly useful or desirable for everyday Internet users, but really nice if you have specific requirements.
So that our device vendors can say:
> I attest that this user's advertising ID is 12345, and for a fee I'll tell you all about what they've been up to.
Think of how much money they're just leaving on the table by letting us authenticate in ways that don't create such a side channel.