But even with passkey you have: - a password, which still can be brute forced if done authentication service doesn’t play nice - resets still need to work som

But even with passkey you have: - a password, which still can be brute forced if done authentication service doesn’t play nice - resets still need to work somehow The only good thing about it is that you will know which auth device is used for a session and that you don’t need 2fa afaict. Unfortunately most information about sessions and attempts isn’t communicated by 99% of the services