Comment by wildzzz
5 days ago
Usually you can setup an alternate 2FA like TOTP, a recovery SMS, or something else you can use to prove who you are. And then once you're into the site, wipe the current passkey and setup a new one on your current device.
But if I can use any other form of 2FA, there is no way I'm using a passkey. The only way I would ever do so is if I have no other option.
I cannot think of any innovation that has required more defensive pleading for people to use it than passkeys. When a HN article has to be titled "passkeys are not a trap", the concept has already lost.
That's what the big corps are trying to do by forcing people to use passkeys by making it the only solution.