My understanding as well. Then there is this quote
“if a user has both a passkey and a password, and both grant access to an account, the account is still at risk for phishing. (…)"
How does a PIN, which is inferior to a password, provide more security, when passwords alledgedly aren’t secure anymore?
This is an obvious grab for biometric data if you ask me. The statements are too contradictory. At some point PINs are gonna get phased out as well. A bit like what they’re doing with local accounts on Win11
You do not use the PIN to log into your account, but to unlock the passkey that is used to log into your account.
A PIN + the need to physically access a device capable of logging into your acount is safer than a password, which is safer than a PIN.
On the other hand, a compulsory 2FA bound to a physical device will create lots of problems when you loose access to your device.