You’re the first person in these comments to mention 2FA with passkeys.
My gripe with passkeys is they are almost always implemented without a second factor.
You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.
With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.
But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.
This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
I think passkeys with single auth are fine because of how they end up being stored and managed.
If you use them via Windows, iOS, Android, or macOS, they are tied to the biometrics on your device. Someone has to steal your device and unlock it to get in. They have to have something you know (phone unlock password) and something you have (biometrics).
In a password manager case, trust is moved from the client device to the password manager itself. It is assumed that the password manager implements these things. For example, my 1Password needs to have both my password (something I know) and secret key or existing logged in device (effectively, something I have, as I don’t regularly type in my secret key as a password and don’t have it stored digitally except for within the password manager itself) to be logged in.
"If you use them via Windows, iOS, Android, or macOS, they are tied to the biometrics on your device."
There are no biometrics on my primary devices, which are desktop computers. No camera or fingerprint reader.
Your client device OS will not allow you to create a passkey without a local unlock PIN/password or biometric, and those local unlock methods do not traverse the Internet (they are handled with TPM/Secure Enclave).
It’s the passkey that should be protected with MFA (biometrics, PIN), not the account with the third party service.
My Yubikey supports passkeys and protects them with a PIN of my choosing. No services need challenge me further.