Technology

I always thought of passkeys as a convenient way to authenticate.

I am password-less on multiple services.

I have an authentication app on my phone that authenticate me when I am away of my computers. I have passkeys on my personal computer and another set of passkeys on my work laptop.

If I have to authenticate from your computer I simply use my auth app, click on "it's a public computer" and I am good to go.

The dude discovered a butter knife and he tries to replace his spoon with it just to realize it doesn't work well for eating a soup.

Passkeys are only good if they aren't in a online password manager. They are better than TOTP 2FA in terms of security and phishing resistance. I see 2FA as a last resort when someone even gets into my password manager. Storing passkeys completely makes this useless, as I'm sure anyone that can log into my accounts would've done so by getting a hold of my unencrypted password manager database. Unless android provides a real offline way of storing passkeys in the device, I am not interested alot.

Passkeys aren't a full replacement in my opinion, which is what DHH gets wrong. It's a secure, user-friendly alternative to password+MFA. If the device doesn't have a passkey set up you revert to password+MFA.

Why not just passkeys with a “magic link” fallback though?

This is the same as forgotten password so ytf not