> Passkeys have been heavily pushed by major tech companies as a replacement for both a username, password, and 2FA method - but (assuming proper 2FA) it's a st

> Passkeys have been heavily pushed by major tech companies as a replacement for both a username, password, and 2FA method - but (assuming proper 2FA) it's a strict downgrade with serious drawbacks. It's really sad to see companies ditching proper Webauthn 2FA support when switching to Passkeys, because it's making security worse for the people who actually care about it. Authentication which requires multiple independent mechanisms is rarely a user benefit though; it is the result of regulatory requirements or corporate risk aversion. If companies are adopting passkeys, it likely means risk that they were formerly solving with a second factor (like weak/passive phishing resistance or credential reuse) are solved via baseline passkey provider behavior. > There are also privacy risks here, as it must by definition be possible to query a token for the existence of an account at a website. You can protect this via the PIN of the security key, to prevent third parties who get access to your key (such as through coercion) seeing which websites you have accounts on.