The cryptography behind passkeys - The Trail of Bits Blog

I’m using passkeys on any sites that support them and 1Password, my secret manager of choice, does a great job managing and storing them. This article goes a bit more into depth on the WebAuthn specification that is passkeys. The additional layers of trust built into the protocol, for example allowing a site to require a certain instance of an authenticator to be used is smart. I think we still need to see if passkeys become useful for regular non-technical users. I worry they can feel a little "magical" and folks will lose credentials a lot. Either way I would much rather see more passkey adoption versus this trend of no passwords and sending an email code every time you login.