Comment by makeitdouble

5 days ago

You still need a password to exist, so while the passkey won't activate the user can still leak the account's credentials.

To cover that gap, you get rid of passwords altogether, and now users lose access if the passkey fails to sync or isn't available on one of their devices (let's say a Kindle Fire tablet)

Passkeys being bound to the domain is neat, but not without tradeoffs and practical workarounds. At least that can't be the only aspect to look at when making a choice.