The general idea behind passkeys (and WebAuthn in general) is fantastic. They're phishing resistant (not totally phishing-proof, but way better than existing au

The general idea behind passkeys (and WebAuthn in general) is fantastic. They're phishing resistant (not totally phishing-proof, but way better than existing auth methods). They eliminate entire categories of phishing attacks around site identity. The UX flow provides users who would not be making secure passwords with strong-by-default security, making password reuse almost impossible. Even the cross-device authentication stuff, while not sufficient on its own for things like backup is still an improvement over copying and pasting keys. Being able to authenticate a device and log in without ever transferring your authentication credentials to that device is cool. That enables some security setups that would otherwise be very difficult to build. Some of the benefits are oversold (the privacy benefits seem overblown, there is nothing about passkeys that guarantees that your accounts won't still require email addresses, and there's nothing about passwords that forces sites to ask for email addresses, so nothing on that front is likely to change) -- but in general, the core idea is wonderful and passkeys would be a massive improvement over passwords if they were implemented well. The problem is the implementation and the development process for the spec.