alt Hacker NewsI'm in small tech saas and users having their accounts breached because they share a password with 100 other services is a constant. I have had to set forced 2FA on many products because we take the blame when the user has their account compromised.
Passkeys offer the same and more security but are less of a pain for the user.
If you also support TOTP and physical security keys as an alternative to passkeys, that should be enough to provide a stable long-term alternative for users of FOSS devices. And of course, RP-side you can choose to never require the remote attestation flag to be set.
Convenience is precisely the thing that big tech established tech platforms want to reward their users with to keep them around. The undeniable convenience of passkeys didn't have to come with a standard that is threatening against unattestable devices like my Linux phone. But it does, and that means passkeys are a way that the industry can discourage people away from using non-Google/Apple/Microsoft-approved devices.