@Xavier@infosec.exchange @drsbaitso@infosec.exchange A website should never tell the browser to accept a passkey without the user explicitly requesting to create it. Good: My pharmacy notices that I don't have a passkey after logging it. It asks if I want to create one now and respects my decision if I decline. Bad: Amazon spontaneously telling my browser to save a passkey when all I've done is open my Order History page. That passkey dialog should never pop up by surprise, in the middle of an unrelated workflow.