@nikitonsky Let me ramble about information security theory for a moment.

To authorize a user, you either check they **have** something (key, card, file, private key, etc) or they **know** something (password, pin, passphrase, etc). If you check both it's 2FA, and that's why storing TOTPs in a password manager is the dumbest thing one can do.

Passkeys provide a good and reliable way to "have" something. Unlike files (e.g, ssh keys) they can't be stolen remotely. Unlike key cards they can't be cloned with a simple reader. It's really hard to create a copy of it, that's why they're good.

But they are definitely not like passwords :)