This is a most excellent place for technology news and articles.
Passkeys are worthless trash, invented explicitly to save Microsoft and Google money on password reset server time.
They do not solve session hijacking. Any attacker that has your granny on the phone to read them her password can also tell granny to go to a link and give them her session cookies.
That's what CSRF mitigations are for.
Do you actually understand how any of the modern web works or does your knowledge stop at W3Schools tutorials from the mid-2000s?
I feel like there's some potential in password-derived passkeys, which would get around the storage and hardware lock-in issues. It'd essentially be a master password like for BitWarden, but instead of needing an app to store a bunch of generated passwords, the master password could be all you need to authenticate.
Most of the sources of compromise for regular users would be eliminated because the password never leaves the client.
