Passkeys are one of the non-phishable means for authentication. If something is easy to recover for user then its same for a malicious actor. Some platform base

Passkeys are one of the non-phishable means for authentication. If something is easy to recover for user then its same for a malicious actor. Some platform based passkeys (apple, google) are actually sync-able across the devices. The whole Passkeys concept is under debate and discussion for what it means for different types of WebAuthn authenticators when it comes to the ability to sync the credentials. Alternatively one can use security keys which they can keep with themselves and could protect themselves by enrolling one additional security key for recovery purposes that they can keep away. Regardless the whole idea is to have more than one MFA factors enrolled so that one is not get locked out. Ease of using WebAuthn/ Passkeys overweighs typing in password, SMS, TOTP codes and has big savings for big players to avoid phishing attacks. It might not be suitable for every use case but worth using for some.