Comment by sholladay

There’s so much FUD out there about Passkeys. They are barely any different from the keys you use to push to GitHub. It’s all going to be okay.

Yes, they have some window dressing and opt-in features that extend the basic concept of asymmetric key pairs. Attestation is only in the spec to appease some large enterprise users for very specific scenarios. Signature counters are in there too, but since Apple decided not to implement (which I’m fine with), they are essentially irrelevant in the general case.

In practice, Passkeys are really quite simple.

We can do this, people. We can move beyond the era where poorly protected password databases are handed around like candy.