It's the second one, not the first one.

The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth.

> the phone will still have the private key and can still do the login

One of the main gripes people have is about whether or not the user actually has access to the key or not.

ie. Can I save my passkey somewhere that I control, can I login on another device, etc. etc. Or do I need google's sync/account to do that for me.

> Google doesn't have a way to MITM that

Google controls the software so it can MITM.

"best have another way to auth"

right, so passwords it is then.

well, the argument is that for strong passwords you will need to use a password manager anyway. Which you will sync somehow, which will sync your passkeys too. So in the end you might as well replace all your passwords with passkeys except for the one password you use to access your passkeys in your password manager / the master access basically. The one way to make sure that you never lose access. I think this makes sense, I'm also very dependent on a password manager now.

Unless there is proof that the hardware on the phone is isolated specifically for this task you cannot make the claim that google is unable to MITM.

Yes, the hardware vendor that controls the kernel and chips can do whatever they want. I meant there is no method as per the definition of the protocol to MITM the passkey because the device only ever emits the public key unencrypted.

Banning has nothing to do with it.

You use passkeys as a preferred login method.

If you do not have your passkey, you can tap "Try Another Way" and use your password as usual.

This means that you still need a password, which you still should store securely.

It just becomes much harder to phish out this password.

Maybe "Passkey" + "Magic sign-in link email" will be a good enough combo for most?

If you've also lost access to your email, you've got other problems.

That makes your email box effectively a password vault. Might as well use a service designed for that such as LastPass, or 1Password.

Or better still, use a password calculator app such as https://spectre.app/

This kind of approach generates your passwords for different sites based on login information and a single password only you know. No other passwords are stored on any devices or services, not even within the app on the device you are using it on.

Which enables you to have different passwords for each service and solves the problem of "too many passwords to remember" without just having to write them all down in a dozen ways that can also be compromised.

Passkeys are open, so you can for example store them in a Yubikey if you want. Else many password managers will soon support passkeys, for example 1Password or NordPass.

https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://nordpass.com/passwordless/ https://www.future.1password.com/passkeys/