Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
Read in full here:
I usually ignore it when Windows ask me to add a passkey.
Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security.
Nice article.