So far, my experience with passkeys has been disappointing: - Many major websites implement passkeys in a hybrid way that you can keep logging in using your pa

So far, my experience with passkeys has been disappointing: - Many major websites implement passkeys in a hybrid way that you can keep logging in using your password (Amazon comes to mind). That actually kills the greatest security feature of passkeys: resistance against phishing. As a counterexample, Microsoft has implemented it as "passwordless", and kills password login fully when you opt-in, but that seems to be the minority of the platforms right now. - UX is worse. On almost all login forms, you have to click on "Sign in with a passkey" button to go through an extra step in the authentication flow, making passkey signing option more work than a password login with a password manager. That also means you must know if you had enabled passkeys on that website. There is no familiar UI design for that either, you have to explore every login form to find out its passkey mode. Password managers like 1Password can detect passkey sign-in options and show up a popup to log you in, but that's mostly a case-by-case hack, as I understand. - Despite that the authentication mechanism is very well-defined, the account recovery flow isn't. I don't know how much risk I'm putting myself into by signing into passkey flow. If I login to everything using a passkey, including my email, how much risk am I getting myself into if I lose my passkey provider account? How do I recover my account then? Is that flow also phishing/scam resistant? - The story of 2FA is bleak. Now that I have a strong authentication scheme, can I safely do away with 2FA? I can't really tell anymore because the risk model has more dependencies now. If 2FA isn't eliminated, and password login is still allowed, what do passkeys gain us by any metric?