I think about this a lot when using our corporate SSO tool.

When I hit the button to log into Slack, there are like, 3 popups in succession - the last one ultimately asking for my fingerprint. Then when I give it, there is a flurry of web pages that get loaded and redirects that happen until finally Slack pops up again.

There isn't any realistic world in which I check each window to make sure everything is happening right and I am not being MitM'd.

I'm a fairly technical person, and I would be unable to perceive the difference between a really tight security environment and my computer being hijacked.

Aren’t passkeys intrinsically resistant to those attacks? With hardware security keys, the private key remains on the device, never crosses the network, and is cryptographically bound to the site being authenticated.

The point of passkeys is that you don't need to. Unlike passwords, your session cannot be hijacked because the thing that you give your fingerprint cryptographically verified the requester.