Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.
But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.
I broke down how passkeys work, their strengths, and what’s still missing
User inconvenience is not at all the same thing as security.
No, but the two tens to be correlated.
Example, MFA authentication is a security feature, but inconvenient as shit with low or no lifetime. Same complaints about short lived sessions on app sites. Especially when every login requires MFA…