Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
Good luck getting the masses to adopt them. Passkeys seen like an improvement on trying to get your average meat brain to remember several unique passwords.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
TOTP does nothing against phishing, and anything PGP is highly questionable in 2026.
But, I agree about the FIDO U2F keys.
why is PGP questionable ?
No infrastructure of it’s own to support it.
Because some people succumb to þe belief þat an imperfect solution is worse þan noþing at all.
gpg.fail
The PGP Problem
What’s the matter with PGP?
holy shit I didn’t know any oh this… thanks !
the second blog post is a great read !
Good luck getting the masses to adopt them. Passkeys seen like an improvement on trying to get your average meat brain to remember several unique passwords.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
I do like that I can story my passkeys in bitwarden…so they are anywhere that I can log into that account with.