Comment by autoexec
5 days ago
There will never be a login that doesn't involve a potentially compromised device/OS/browser/password manager. As long as using a passkey means using those things too, having a passkey isn't enough to keep attackers out of your accounts. They can be pretty good about keeping legitimate users out of their accounts though. You just have to weigh that risk against the risk of you falling for a phishing attack.
Security is never perfect, if your device is already compromised, you have bigger issues. None of the traditional methods would protect against compromised devices anyway.
The point is that passkeys significantly reduce the attack surface.