So what exactly is being transferred with this new cross platform mechanism? Isn’t it the same private key, except that it’s a direct device-to-device transfer?
This export and import of passkeys also seems to blur the lines between passwords and passkeys a little more. If every device supported a built in password manager that generates a random password on signup with a service, stores it securely and then the platforms implement a secure password export and import mechanism where the CSV/JSON/whatever file is encrypted and kept only in memory during a direct device-to-device transfer, that would be close to this, right?
Other than passkeys being randomly generated for each site (and linked to it) and tied to some kind of biometric authentication, it looks like passwords and passkeys are converging (except for some implementation details).
The biggest advantage (which could also be considered a disadvantage from a different angle) with passwords is that one can use it from any device without having their primary device close by. With passkeys, the primary device must be close by if one wants to authenticate with a service on another device.
The biggest disadvantage with passkeys is that if one’s primary device is lost, they wouldn’t be able to login to services. The recovery process would also have to be the same old personal information check or (ugh) secret questions or a link sent to an email address or (ouch) an OTP by SMS to a new replacement device.