Comment by TrayKnots

I got quite recently turned off from passkeys. I used it on my gitlab. Stored in my password manager and was unable to log in via my phone.

Turns out, my Android version is too old. I can only use pass keys stored in google. It doesn't support using them from another provider. Need a newer version.

The argument that TOTP could be entered in the wrong domain... Nope, my password manager wouldn't propose my TOTP on the wrong domain. Hence, that is solvable. But if I wanted, I could still do it. Sure, I can be phished. That's my risk. But I can also log into a domain who has moved, or far more likely, use the password manager to fill out the 3rd party android app for that service.

Yea, that article did not convince me a single bit, the original article convinced me a whole lot.