>If we learned EXACTLY ONE THING from the Crypto Coin world it was this, if you put something valuable on your computer or your phone, PEOPLE WILL WORK DILIGENT

>If we learned EXACTLY ONE THING from the Crypto Coin world it was this, if you put something valuable on your computer or your phone, PEOPLE WILL WORK DILIGENTLY TO STEAL IT. Often in creative ways like otherwise silent drive by clickless exploits in browsers delivered by Ad Networks. So you don't use a password manager, and instead use the same password everywhere (or at most a few of them), along with the same email address (or perhaps a couple of them)? If so, you should be made aware of credential stuffing: https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing >What part of "Good security is security where you don't get to run code on the device providing the security, ever." did they miss? You have misapprehended how Passkeys is implemented; the site you are accessing does not run code on your machine for Passkeys. As an aside, the site requesting the Passkey is part of the signed response; in other words, malicious sites impersonating a site cannot cause your browser to generate a Passkey for the site they are impersonating. If you are so worried about sites running code on your box, disable JavaScript entirely in your browser.