> That in itself is a good reason to only use uncloneable credentials like a Yubikey for sensitive uses. Yup I really don't get this. For once we had somethin

> That in itself is a good reason to only use uncloneable credentials like a Yubikey for sensitive uses. Yup I really don't get this. For once we had something that made sense: an actual 2FA which required an actual physical device. And now with the alliance between Microsoft (which we know can always be trusted), Google an Apple the 2FA not only is becoming "1FA" (because the goal is to use the passkey instead of the password, not in addition to it). But transforming the 2FA to 1FA is not enough: we cannot let these secure hardware module make live hard for law enforcement (uh, sorry, for bad guys) so instead of having "no device, no login" we get instead "copyable passkey". "1FA copyable passkey" What a concept. Somehow I feel this isn't exactly going forward security wise. Then people will say: "but it's easy. but it's convenient. And moreover it's pushed by our beloved Microsoft!". Yup, exactly.