There's a nice security improvement to passkeys, as well. No more passwords getting leaked from poorly-run websites, security breaches, etc. You can dump an entire user database and nobody is compromised outside of the obvious privacy implications.

The biggest security benefit of passkeys is that it raises the floor of security posture for the least security conscious users. E.g. You can't use "bob1989!" as the your password on every single site, write it on a post-it stuck to your monitor, and enter it into every site that sends you an email claiming to be from "M1cro3oft Supp0rt".

For users who already have a very good security posture the security benefits are pretty marginal. For example, I already use a long, unique password for each site via my password manager. If a site gets breached it will only affect that specific site, and even then only if they store passwords in plaintext. My passwords have enough entropy that even an MD5 hash is unlikely to be cracked in an offline attack.

> I'll just start storing passkeys in my password manager instead of passwords wherever possible

Depends on how the password manager stores the passkeys.

I noticed that bitwarden stores TOTP keys such that the secret is exportable. Which means that if you're bitwarden wallet is compromised, even temporarily, the TOTP keys can be stolen.

If the password manager just stores the private key as an encrypted file, then it would probably be better to use a yubikey, iOS or Android device as those are designed to prevent the key from being extractable.

But maybe password managers will store passkeys a HSM.

I don't plan on using an HSM to store my passkeys anytime soon. The security benefits are marginal for me compared to the huge inconvenience of having to manually update my credentials on hundreds of sites every time I buy a new HSM.

I'll continue to use WebAuthn hardware keys as a second factor for the small minority of sites where that makes sense. For the rest I'll just use passkeys synced to my password manager.

You have a (constantly expanding) choice in what software or hardware your passkeys are provided by, and can decide based on your own risk/convenience trade-offs.