"Better things aren't possible" is a terrible outlook. There have been real improvements in this space, such as passkeys, and recognition that some of this stuff, like frequent password changes, is counterproductive.
In what way are Passkeys, as implemented (not theoretical benefits), better than passwords?
Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.
They're better in some ways. They don't rely on a secret with low entropy which is really brute forceable. They can't be used on a phishing site because the URL is part of the secret. Even when you authenticate to a fake site you don't give them the ability to authenticate as you until you change the secret (like you do when you give them your password)
They also have 2fa built in. No need for a separate app, entering codes whatever.
That's why I mentioned "and also enabling authorised access to that same resource". Passkeys are great at preventing unauthorized access. But that comes at the expense of preventing authorised access. For example, using another device or even moving to another device. Replacing a stolen or damaged device is also nearly impossible with a reasonable quantity of Passkeys.
Well that's why they can sync between devices. I don't really see the problem.
Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC.
If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't matter.
> Well that's why they can sync between devices. I don't really see the problem.
How do you sync passkeys to someone else's phone to authorize them to act in your name?
This is the basic use case, very common in the physical world, that security industry refuses to accept exists.
Passwords have this capability by nature.
> because most services don't allow you to enroll more than one passkey
Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.
What Passkey implantation syncs between devices? I've only ever seen "cloud sync", e.g. syncing with someone else's computer. Can a user sync iPhone passkeys with her Boox E-ink tablet (Android)? Can either sync with a Debian desktop?
> There have been real improvements in this space, such as passkeys
Passkeys are not an improvement. The way they're being implemented entrenches middlemen into auth flows in a way that reduces users' security in a broader sense, while being just as susceptible to compromise as any other form of credential.
Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.