That said, what you describe is easily doable in other forms. For hardware tokens, you can have a spare Yubikey that's authorized on your accounts and keep that in a fire safe with its unlock PIN. For something like 1Password, you can print out a recovery kit [1] with the secret key and unlock password.
Agreed, I'm just not willing to endorse their use until there are robust recovery and remediation processes.
> For something like 1Password, you can print out a recovery kit [1] with the secret key and unlock password.
Yeah, this is what I want Google/Appleto provide as it is robust to both user incapacity and provider refusal-of-service.
They seem ripe for corporate use where ransomware and phishing are common threats and IT can manage account resets by walking over to their desk.
The idea that printing a backup is easy and an option for many people is often not the case.
Fair enough, but that is an argument for multiple durable recovery and remediation solutions, which few of the current providers have.
For all of its many weaknesses, a password has that one major advantage over all the other authentication methods, and unless a new method provides a similar advantage, most people will keep using a password, just like they did even with the appearance of private keys, biometrics, USB tokens, SMS or TOTP.
I go out on a limb and say one smartphone usually - that is at heightened risk of getting stolen. With passwords, the person would probably just pick something they can remember in case the phone gets stolen. With passkeys, what should they do?