I assume you already know how u2f (Universal Second Factor) works, what is webauthn standard developed by Fido alliance is, and so on. The Wikipedia article is detailed enough if any of those words…

Community Picks is a section on daily.dev where our community members share the most interesting and valuable content they've discovered online. From insightful articles to handy tools, every post is a gem curated by our dedicated coomunity. To contribute to Community Picks, you need to have at least 250 reputation points, ensuring that only active and trusted members can share their finds.

Community Picks

Apple introduced a controversial ‘improvement’ to webauthn called Passkeys, which could impair the security of your most valuable online resources. With ‘pre-Passkeys passwordless’, you could secure the trust relationship between your computer and a service, say, a crypto exchange. When Passkeys proponents say it is a huge step forward.

What is wrong with Apple Passkeys?

Well, that article is overbearing in a way.
WebauthN does allow for what is called roaming authenticators. Roaming meaning that the key material is not stored in a non-exportable fashion. Nothing wrong with a roaming token, provided the implications and indeed the reduction in security is understood.
The author of this article is right in the case that roaming authenticators are not suitable for certain usecases. Is Passkeys a bad idea? Well, I think it is a whole lot better than what loads of people do nowadays… using the same credentials over and over and over…
I don’t think Passkeys is aimed at corporate or high security usecases. And with that, the choice for a roaming authenticator protected by a biometric credential is a strong usecase.

Well said, it’s essential like the role of password managers for passwords. Somehow the extra convenience is actually taking the overall security to lower levels.