Comment by WorldMaker
5 days ago
2FA exists because defense in depth. Even if passwords weren't phishable, it can still be handy to defense in depth that a person is who they say they are by checking multiple factors ("something you know", "something you are", "something you have").
Passkeys largely meet 2FA requirements by themselves because they are "something you have" (its stored on a device you own) and require "something you know" (device PIN) or "something you are" (biometric unlock) to use.
I would say its something you have when it’s hardware backed, including secure enclave/pin/face id, but a cloud sync’d password manager isn’t necessarily that, though, again still a better situation than a phished password.
It's still not quite something you know or you are, so it is a different factor, even if we can quibble on if it is more weakly "something you have" when not hardware specific.