Comment by eluusive

The way passkeys have been implemented is an absolute travesty. If it were one passkey per device, and 2-factor was still being enforced, I'd support them. But

But, instead, we end up with 1 passkey per device (potentially per web browser) per website -- and some websites do not allow any other kind of auth. If you lose that phone, or wipe it, move on, or it is compromised, now you can't login to your account anymore?

There is literally no reason for all of this nonsense.

Websites should be providing a challenge, your device should produce a tweaked key based on the domain, sign the challenge, and that should be it. You have one root key per device.

A standard API to register new passkeys for new devices.

Require two factors Password + passkey, or two passkeys.

No transferring private keys between devices.

Requiring 2 factors per website per user, potentially per device, is far more complexity than most people are capable of dealing with.

And I really do not like that my phone# and email# are now de-facto second factors on everything.