Comment by jasomill
5 days ago
Passkeys also open up other use cases like using a mobile device or hardware security token to log into sites from public computers, which, while not risk-free (targeted malware could still hijack your session while you're logged in), is still significantly safer than giving the public computer a password.
This is roughly analogous to the difference between swiped/card not present and chip/NFC credit card payments. While a hacked chip/NFC credit card terminal could display a different amount than actually charged, it can't subsequently make additional charges after the card or device is withdrawn.
Though obnoxiously, the public computer login method doesn’t rely solely on the QR code it shows, but also uses Bluetooth. So if you want to log in on a VM or computer without Bluetooth, or a physically distant computer being accessed remotely, you have no choice but to install your password manager on that computer. Which is a lot less secure than copying a single password and one-time code.
VMs and remote access can implement passthrough for passkeys, just as passthrough has been implemented for smart cards (CCID).