[jesseendahl]

(1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware.

(2) I understand you don't like the user experience. But to make a technical clarification: requiring a user action to prove there's a human involved in the login action (e.g. by clicking a button in UI or requiring Touch ID) does not necessarily mean there's another factor involved at all (MFA). What you are describing is more of a "liveness check" than a separate factor/separate credential.

[alyandon]

  (1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware.

Challenge: Go and try to register a non-blessed passkey type with PayPal and come back and share your experience.

  (2) I understand you don't like the user experience

Pretty much my complaint. Passkeys allow for service providers to do dumb things that result in terrible UX. With Password + TOTP, I don't get asked to touch a sensor, enter a PIN, enter an unlock password, etc.

[spencerflem]

I actually kinda like the enter-a-pin flow, it makes me feel a lot safer about letting someone hold my phone. I just hate the lock-in it adds

[spencerflem]

Liveness check is fine, but I’ve always seen it as requiring Microsoft Hello or equivalent explicitly, and not whatever check I would prefer to use