Roaming authenticators offer what other passkey solutions can't - but there are trade-offs

"Let's face it. When it comes to passwords, we are truly our own worst enemies. Too harsh? I don't think so. We're doing everything we can to make it easy for threat actors to inflict their worst -- from the exfiltration and distribution of our sensitive information to the emptying of our bank accounts. Given how frequently end-users continue to inadvertently enable these hackers, we've practically joined the other side."

"Realizing that training and education are apparently futile, the tech industry decided on an alternative approach: eliminate passwords altogether. Instead of a login credential that requires us to input (aka "share") our secret into an app or a website (collectively known as a "relying party"), how about an industry-wide passwordless standard that still involves a secret, but one that never needs to be shared with anyone? Not even legitimate relying parties, let alone the threat actors?"

Passwords are highly vulnerable because users frequently fall for phishing and social-engineering attacks, enabling attackers to steal secrets and access accounts. Research shows even trained users often disclose passwords to phishers. Passkeys provide passwordless authentication by using cryptographic secrets that are never shared, cannot be guessed, and are unique per site. Implementing passkeys requires authenticators and supporting technologies and standards. Authenticators can be platform-bound or roaming, with roaming authenticators typically more complex yet offering stronger security. Passkeys reduce credential reuse and phishing risk but require device support and coordinated adoption for widespread deployment.

Read at ZDNET