hawksley.dev

The article argues passkeys are technically strong—phishing-proof and breach-resistant—making them well-suited to enterprises, but a poor fit for individuals whose bigger risks are lockout, account bans, and device loss. It details pain points: hardware keys can't be backed up and have per-key credential limits, platform-synced passkeys tie you to Apple/Google accounts, export/interoperability is immature, and cross-device login is clunky. It recommends passwords in a third-party manager plus a separate TOTP app, except for habitual password reusers.