So true.

And every critic always attacks this same thing. TOTP isn’t so bad, my password manager can do it. 2FA is fine it’s automatically pulled from my phone.

It’s still phishable. The password is still sent. You haven’t solved anything, you just piled more complexity on top to make it harder. People can still use the same password at 12 websites.

Passkeys never get transmitted. If you hack into a server and steal my credentials, all you get is a public key. You can’t use it at another website. A bad developer can store my password or TOTP secret in a way that makes it useful to a thief. That’s not possible with Passkeys.

No one ever offers an alternative other than saying it’s irrelevant. Despite practical experience showing otherwise.

Passkeys work and make my life better. These constant rants remind me of seeing people argue that the GUIs are a waste of time and no one will ever use them and it’s a fad that will go away and the only reason everyone’s talking about them is companies want to sell graphics cards and mice.