Passkeys can be transferrable and syncable ( see keepassx, bitwarden, and relatives). But ideally, eventually, you never sync them because every time you log into a service with a new device, that device gets its own passkey. No need to sync them and you can revoke a devices access if it is lost or stolen without effecting any other device. They are closer to client certs than passwords in that respect.

means to deny service to anyone whose passkeys do not match the service provider’s preferences. This is a non-issue with passwords, since there’s no way for a provider to tell whe

Yes it is. I have had to work with many companies that set password specifications, and sometimes they prevented secure passwords. My bank maxed out at 11 characters for many years!

You dont own the specification for a password, the service provider does. I always wanted to use deterministic password generation (i.e. hash(servicename + memorable password), but never could because every provider has different “password rules” about different character types, etc.

Imagine instead of inventing and storing passwords in your head and typing them in each device. With passkeys each device generates a real, cryptographically strong password for each site and stores it in a secured part of the device. Nothing to memorize.

Sites must now to let you have many passwords so you can have many devices without needing to sync between devices like a password manager might do.

No one can guess your password and it is never reused because they are machine generated. They are protected on device by the security of your device (typically behind a pin) so if you trust your OS, it is safe (which, in effect is the same as passwords you type).

Unfortunately, the experience still sucks and shitty companies might use them to further lock people in if they end up with all their passkeys on one iphone, for example.

Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.

They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.

If someone made a board with like 8 slots for ddr3 and a socket for a decent cpu, it would sell like hotcakes. Basically free ram.