Post

A push prompt can be approved by a tired user on a fake sign-in. A passkey gives that user nothing to approve on a lookalike site, because the browser only offers it on the real domain.