Comment by Gigachad
5 days ago
Because password managers allow you to use a password and 2fa even if the url doesn't match. And sites often legitimately change domain or have multiple domains which trains users that sometimes it doesn't work and you have to override the automatic matching.
Passkeys physically don't allow you to send them to the wrong sites so the sites have to make sure they keep working.
So password managers work right up until you stop using the password manager. This also applies to passkeys magic protection against phishing. Because of limitations with passkeys, there is always an alternative login mechanism or recovery process and that is just as easy to phish. Maybe easier given the complexity of passkeys and befuddled users.