The passkey is worse

Today I got a strange email that turned into an unsettling phishing experiences. // If you’re just here to read about how bad passkeys are, skip to part 4 It Started With a YouTube Support Ticket I thought someone from Russia created a support ticket with YouTube to take over my gmail account and I needed to click on their link to reject the support ticket. Oops. The Google Login Page Looked almost Legit But I was already logged into Google in another browser tab. So why was Google asking me to log in again? I even noticed sites.google.com login page, but proceeded anyway thinking that this was just a weird auth flow for a support website (its common for companies to require you to login separately to a support ticket website from your main account) I copied over Google credentials from my password manager. Then it asked for my two-factor authentication code. I copied and pasted the correct code. It failed. I tried again. Failed again. Then the Apple Passkey Prompt I really wish I…