I still don't get passkeys.
Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost every service provides".
But then what have I gained, if there is still an email fallback?
Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost every service provides".
But then what have I gained, if there is still an email fallback?
The same is true of passwords, of course; if there's an email-based password-reset mechanism, then your email is your real proof of identity; the password is a shortcut.
Passkeys are a shortcut too; they just pick a different set of tradeoffs (less portable, less user-visible, more secure, harder to get phished, less stuff to remember). IMHO, these tradeoffs turn out to better-match the threat model of the modern web.
So I see why passkeys improve on passwords, but not on 2fa.