YOU'RE THINKING ABOUT PASSKEYS WRONG

Summary from the TLDR InfoSec newsletter

Some in the security community have argued that passkeys have failed at their promise of passwordless authentication and should instead be used as a second factor due to complexities such as account recovery on a new device. The author of this post argues that this reflects an improper way of thinking about passkeys and presents a login/registration flow that uses magic links for new device/registration and then uses passkeys for subsequent access.