Any comments?

https://www.theverge.com/2023/5/3/23709318/...curity-phishing

not sure. basically google passkey is 2FA as well. u need to secondary authenticate ur identity when u login. that is 2FA.
instead of keying in TOTP from an app or sms, u authenticate using another form of 2FA. like windows hello.

> Is google passkey more secure than F2A etc?

Only if the device where your passkey is created and stored is secure. *including any other devices where the passkey is synced to.

It is a replacement for passwords not 2FA. If I understand it correctly it works a bit like those old SSH keys.

These are two files matched with each other. The server keeps one, and you keep one. If it matches, you are in, if not you do not get access.

There are other ways to make sure that the keys are correct e.g. certs, ip checks, additional passwords etc. The additional authentication when you use the key is the 2FA I guess.

1) passkey (something you have)
plus
2) password (something you know) or biometrics (something you are)