> This is honestly how I think about passkeys: they're a standard API for browsers and websites to integrate with password managers without needing a browser extension to manually look for and fill out text inputs on the page.
But it isn't always that simple. I have a work laptop. It has a MDM installed, so I can't trust it. I don't run my personal password manager on it, ever. But occasionally I go to a web site I don't care too much about, whose credentials are stored in my password manager. It's not an issue; I just type that password in. That doesn't work with passkeys.
Then there is backup. If I lost my password store I'd be toast. Which means if the company that manages my passwords took a dislike to me and banned my account, I'm in a world of pain. I deliberately choose a password manager that makes that unlikely, but not everyone knows to do that. Many people use Google, Apple or Microsoft as their passkey manager. These companies have seen fit to ban accounts without warning and no recourse.
My password manager lets me export all my passwords as plain text, so for my passwords this potential for lock-in is a non issue - I just export, encrypt, upload the result to a few places, I'm safe. I can always upload the data to a another password manager. As that doesn't work for passkeys, I don't use them.
Passkeys will become acceptable to me once multiple independent storage providers become available for passkeys, and they allow me to freely choose other certified others as a backup. Until that happens, they only solved half the problem. It looks to be the half that locks their customers into their platform.
PS: this doesn't require much. Just Google/Apple to implement CXS along with government providers, and we are there. But it won't happen any time soon.