> It's no longer "something you have" when it can freely be copied, including by a casual passerby or a virus Yup it's very sad. It's better, for regular peop

> It's no longer "something you have" when it can freely be copied, including by a casual passerby or a virus Yup it's very sad. It's better, for regular people, compared to passwords but it's a complete step backwards compared to actual physical secrets stored behind an HSM (like inside an actual physical FIDO2 device). It is pure insanity that FIDO2/webauthn was, at last, getting somewhere and that we had something secure gaining traction and that the standard has been embraced and extended by the likes of Microsoft (and Apple and Google) to then greatly lower its security. While still pretending it's all still FIDO2/webauthn. And as I understand it it's really bad because companies using passkeys shall be able to force their users to use the less secure form of passkeys by actually refusing passkeys from those offering passkeys where the secret never leaves physical hardware. For a start it is pretty obvious that the less secure Google/Apple/Microsoft "password stored in a file on your desktop" (and backed in the (i)Cloud: what a concept for security keys!) you mention shall be accepted everywhere. While it's highly likely that at some point, "because convenience", they'll cut off passkeys vendors offering actually secure devices. And it's likely we'll have at the same time "security experts" explaining it's a godsend security-wise. > So now when you use Passkeys we'll need to add another 2FA instance to properly secure your account... As long as it's actually possible to do so. I fear that at some point it's going to be passkeys are the only auth option and by the way we accept "software passkeys backupable to the cloud" only. It's just sad. When you think that the original implementation of FIDO allowed users to detect if their security key had been cloned, thanks to the monotonic counter (I know for a fact because I verified this myself, with cloned security keys, both before and after Google removed that monotonic counter )... But since then Google (and others) removed that check (so it's already impossible to detect if your key has been cloned). This all makes me think there's more to it than "just" Apple/Microsoft/Google. I think it's highly likely some three-letter agency was involved in the "enhancement" of the standard.