> On the other hand, if that's the result of doing that, then there'd be no gain. Yeah, we'll just have to wait to see. Passkeys are just big enough and differ

> On the other hand, if that's the result of doing that, then there'd be no gain. Yeah, we'll just have to wait to see. Passkeys are just big enough and different enough that I think they are exposing a lot of the holes in existing modeling of authentication. For example, a party may not want to rely on a separate piece of software or cloud-backed data for authentication, but that is the reality for password managers today, as well as text messages and TOTP for a lot of people. What are these factors that would always survive an attacker getting access to a user device and to their cloud account? You quickly find yourself in the realm of issued hardware key fobs and in-person identity verification for account recovery.