Comment by 1010m

Thank you for posting on this. The last post on passkeys was utterly confusing and I have been thinking about this until yesterday. I had done some research for a client and had referenced your blog. This whole FIDO2 cryptography-based passkeys system is confusing even to a technical person, let alone convincing the general audience. After bringing together all the different types of passkeys, I had categorized them into three main categories:

1> Synced Software Passkeys (e.g., Google Password Manager, Apple iCloud Keychain): Encrypted locally but synchronized across a cloud account.

2> Device-Bound Software Passkeys (e.g., Microsoft Authenticator app on a phone): Only inside the physical device's secure hardware chip.

3> Device-Bound Hardware Passkeys (e.g., YubiKey, RSA iShield Key): Permanently burned into a dedicated physical USB/NFC chip.

I advocate for "Device-Bound Hardware Passkeys," but not many websites support them. Keeping a duplicate hardware passkey is important in case the original hardware key is lost.