> Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? Sometimes. The authenticator you

> Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? Sometimes. The authenticator you choose to use sets the policy of what makes a valid authentication. So if your authenticator is "Google Password Manager", it is whatever steps you need to get into your Google account and enable the password manager. If you do not have the infrastructure to get into that account (say, you have a SMS fallback and your phone is dead), you'll be locked out. If your authenticator is say a hardware security key, then most likely losing that key means you have no backups. Even in this case, you can have more than one mechanism to recover access or to prove who you are (even if it is a second hardware key at home in the safe).