They also push google oauth. If you're logging in to over a dozen sites with your google account, it becomes that much harder or at least more annoying to curate all of those. They're banking on people choosing convenience over security - and they'll be right.

They don’t, well, not any more than passwords do.

In lack of further context, and thus conjecturing, maybe as a leash/ransom? "If you walk out of our (Google's) line, we will kill potentially decades of your history".

more like the garden of weeds is spreading out of control. they want passkeys and oauth so they can become the third-party gatekeeper for everything.

the want them tied to bio because your fingertip or face are harder to share with others, harder to fake, easier to track multiple accounts with, and are tied to real people and identities that can be linked with other data their databases all to make their data and targeted adverts more profitable.

I can use my yubikey with PayPal. Although it's only 1 key allowed at a time. Still some progress

I love how companies like PayPal claim to need your phone number "for your security," and then you find out they do insecure things like this

But passkeys are NOT MFA. They essentially replace "what you know" with "what you have". Adding a second passkey like a yubikey only furthers the single factor. Also courts have ruled that you can be compelled to provide biometric data to unlock your accounts.

I suspect Google is moving to replace passwords not out of the kindness of their hearts but to allow the government to get into your account.

My preferred MFA combination is yubikey (or similar physical key) + Password/PIN.

Use a password manager and you'll only have to set it once. And prevents you from getting screwed by lost devices.

Think of a passkey as a specific "device" getting access to a service.

Device is in quotes here since it's really tied to the browser and your session on that browser so if you use multiple accounts or you use incognito mode, you will create a new passkey with each session.

You set up a passkey on each "device" you are using Google and then manage those keys through Google's account security web site, deleting keys as needed.

I'm personally not a fan of passkeys as a replacement for passwords. They provide a second factor but should not be relied upon as the only factor for authentication.

passkeys are way for a token unlocked by your device’s biometric sensor to validate a request. biometric information is not sent to Google.

The standard is implemented by multiple vendors, Just like HTTP Basic Auth is. It is not Google specific