u/PURELY_TO_VOTE

I was recently compelled to move to passkeys for my HSA account. What's more is that, no, I couldn't use something like a Yubikey. I had to install the company's app on my phone to authenticate.

It's hard to see how it's not clearly obvious that this is how things will go. I have plenty of accounts that I only ever log in to once every six months, using my laptop. The companies behind those accounts are surely besides themselves with glee that now, under the guise of security, they can now require I put their app on my phone, vastly increasing their ability to collect data and bug me.

Why let the user authenticate with a third party manager app or a yubikey when all the corporate incentives point the other way?