passkeys are a website telling you they don't trust you to manage your own password, and they would rather talk to your password manager directly and skip the meatbag in the middle.
and the websites are usually justified in saying that.
and the websites are usually justified in saying that.
But also, right now giving a website a passkey basically means being technically savvy or using a sensible system like the browser/OS. TOTP used to be this way, but then people got annoyed at the process and put everything into 3rd party apps that synced across devices. The same will happen with passkeys, at which point "passkeys are a website..." will morph into "attested passkeys are a website..." and the rest will remain true.
But what was (is?) wrong with FIDO / webauthn?
based on the marketing copy usage,
from what I’ve seen.
Is that pretty much everyone else’s experience?
passkeys are hardware backed. it's the term for the browser or password manager exposing the secure enclave in your phone or computer as a webauthn credential store, just like a standalone security key.