I love passkeys as a tech enthusiast with a password manager that can hang on to them but I don’t love them as a confusing user experience for the average joe.

I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.

You’re the first person in these comments to mention 2FA with passkeys.

My gripe with passkeys is they are almost always implemented without a second factor.

You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.

With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.

But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.

This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.