The very last thing, past the conclusion, the very last footnote is:

> Addendum: I feel I have made a compelling case for passkeys in this article. And I haven’t even pointed out one of their best security features: they are (in most use cases) domain-bound, meaning they are resistant to what are called Man-In-The-Middle attacks.

"I made a compelling case... but didn't point out the most important security feature that motivated passkeys in the first place"

Honestly I don't think this post did make a compelling case. There's a lot of assuming bad faith on the part of the FIDO alliance, while completely missing that preventing MITM attacks was a key design feature. The FIDO alliance members deal with stolen accounts all the time, and passkeys largely solve that. Stealing accounts is almost always done with phishing or social engineering, and passkeys solve the former and reduce the surface for the latter.

I sort of started skimming when the article was saying industry solved the problem with text messages and TOTP. I think there are several arguable problems with Passkeys as implemented, but to argue TOTP is equivalent is going to leave lots of people vulnerable.

The protections against MITM you mentioned is probably the biggest one, but the other one in the back of my mind is TOTP is a shared secret. So a compromise of the server side allows impersonation of users undetected, which can be a big problem. Maybe I'm over reacting because no company has ever lost a copy of it's database and they're all super secure. But, imagine trying to argue as a user I didn't do a thing when there is an audit log saying we challenged the user for TOTP and it was provided, was definitely the users fault.

It’s not just man in the middle.

If the credentials get stolen from a website database, they’re useless for every other website on earth. No matter how poorly they’re stored, it’s just a public key and is not useful. Hell, they can get code executing on the webserver that collects full login information, and it’s not useful.

Passwords always require full transmission. Hashing for storage requires a proper implementation, which we’ve seen does not happen. 100% of the time. There’s a reason hackers are still stealing passwords from websites after three decades.

Passkeys solve that. Nothing else available to the average user does.

Then why do we need all the stuff about attestation and data bits?

PKI already prevents man in the middle attacks.

Users constantly fall for website impersonation, this can be solved by your password manager it just has to check the host and the certificate of the login page.

Now browsers don't let password managers do that, I wonder why.

But lets say you don't like the fact that passwords are sent over the wire. I get that I don't like that either. You could just take a random token and have an hmac signature on all your requests, for most cryptographic hashing functions that would probably be quantum secure as well.

But lets just say you don't want to have a shared secret because you know servers get hacked all the time. Totally legit, I like the way you think, asymmetric cryptography it is.

How could we possibly do it? Like ssh with pki on top.

The spec could be literally these 25 words:

Do what ssh does but request a PKI signed certificate instead of a key signature from the server and validate it against your known CAs.

Why is your grandpa or fictional billions users being MITM’d?

Passkeys are an end run on general purpose hardware largely under your own control, which is a much bigger issue in scale than dealing with customers who can’t access the services they pay for because of some byzantine security or know your customer laws/procedures.