alt Hacker NewsPasskeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users.
You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site.
As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.
The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.
> As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.
That is not true. Passkeys support device attestation, enabling websites to lock you out if you don't use their approved devices. Which is happening with all the big platforms right now.