your phone, but the complaint in the original article is about those who don't use great security practices, which is most of us. Passkeys limit the attack surface to just your phone. With passkeys, attackers can't get your password (that regular people reuse everywhere) from some weak website or from phishing and then use that to impersonate you. We must go to something like passkeys.

GP seemed to be talking about physical access.

How would passkeys stop them if they are are in physical possession of the device and can unlock it? It doesn't seem passkeys protect you more here.

I was trying to acknowledge that. Passkeys, passwords, same result if someone has physical access to your phone. The improvement is that passwords don't require physical access to your phone, there are other ways to steal those like with phishing or hacking a website that has a copy of a password that you reused. Passkeys solve that problem.

That's fair; I just don't know that security will ever get to a point that's both easy for everyone and secure, but maybe I'm being a pessimist.

It will never get to that point completely, but we can definitely make strides towards it

Passkeys makes your phone the only target, without your phone you can't access anything but with your phone you can access everything.