Comment by PennRobotics

Passkeys work because you always have the hardware for them.

Suppose I had only passkeys and Google Pay. I take a train into town and lose my phone. What then? I'm screwed.

I couldn't just go home because I'd need to buy a ticket or taxi using my phone. I couldn't buy a replacement phone. I wouldn't be able to online shop on a library computer or withdraw money unless I have a physical bank branch. (I do not.) I can't even contact anyone unless I know their number and borrow a phone or find a way to send an email.

My preferred balance of risk vs convenience is: passwords in a password manager, hardware-based 2FA only for making account changes, and confirmation emails (My email password is not in my password vault.) any time a site successfully or unsuccessfully processes a login attempt.

There is no hardware element. If someone phishes my password, I'll know right away from the login email, unless they're so talented or lucky that they also accessed my email or found a way to spoof my 2FA. If I lose my phone, I'm not totally helpless. I don't see an overall downside to my strategy that isn't worse than passkeys.

-----

Edit: One suggested alternative I can fathom is "passkeys managed by password manager". While this does provide better security than "passwords managed in a password manager", my experience has been that passkeys are not well-implemented across all platforms where they Just Work(TM) on every site. I don't know how you'd go about using passkeys in a shared public computer setting (university lab or library) unless you can install browser extensions (and why would you want to, even if you could?). At the end of the day, these passkeys are still secured by the password manager's single master password. Regardless of what I use, I want emails when a login attempt succeeds or fails. It takes one full second to swipe away at my convenience, and I would instantly become alert to an attempt or login I didn't execute.