Technically the truth, but an argument can be made that 2FA was mostly more secure by virtue of how bad password security is, and selling a switch to passkey as a convenience is a big security win.
Also with passkey, you’ll be commonly be forced to do some sort of device unlock making it generally the “thing you have” require either “thing you are” or “thing you know” so it becomes effectively 2fa.
lovely_reader@lemmy.world 19 hours ago
Yeah, password on its own is weak. Any factor + password will always be a lot more secure than password alone OR the other factor alone, but pairing stronger factors of course results in stronger pairings.
Passkey is a device check (the key lives on your device and nowhere else), so it relies on your device security, even if it’s just a PIN…and there has to be a backup option in case you lose access to that device, in which case the account only ends up as secure as that authentication method…which hopefully isn’t password alone.
jj4211@lemmy.world 10 hours ago
Though passkeys are now commonly shared across devices. That was one of the changes they made. For example, chrome will gladly do all the passkey management in the Google password manager. Under Linux at least there’s isn’t even a whiff of trying to integrate with a hardware security device. First pass they demanded either a USB device or Bluetooth connection to a phone doing it credibly, or windows hello under windows, but now they decided to open it up.