Re: Great!
> The passkey is generated on your device! The only thing shared with the service you are using is the public part of the key! The private key is never stored anywhere except on your device!
Done properly, as with any public/private key system, the private key key should be generated and stored solely locally - and should from that point on be easily and clearly located and managed locally.
SSH being a good example of that - and you'll find plenty of people here who understand SSH (as well as, IMO, a growing proportion who don't understand SSH, even amongst those who actually use it). Similarly PGP, although (again, IMO as we don't have figures) there are fewer who know PGP than SSH.
BUT as with everything, these things can be done improperly: it is perfectly simple to set up a web site that will offer to generate SSH and/or PGP keys for you. Of course, you would have to be insane to go to a website and let it generate private keys for you! Who knows what a random web page is doing?! It *might* be running entirely local JavaScript and not doing any more comms to the outside world after the page load is done, but can you be sure of that? And can Joe Bloggs?
Now look at your web browser as it offers to create passkeys for you.
Gosh, doesn't that look just a web page that is offering to generate private keys for you?
Now, one or two of those offers *do* look sort of like part of the browser's own UI, very similar to the one it uses when offering to save your password for this site (only used for low to zero value sites, of course). Note the "looks". Others appear in the middle of the page, with varying appearance - now, are those happening purely locally? Even the ones that are branded?
> The ignorance on this site is astounding!
And do *any* of those popups provide any guidance whatsoever on what passkeys are, how they work, where you can find any reliable information on all this? Nope. Not that I've been offered[; have you fared better?[1] OTOH if you feel like getting into PGP you can easily (well, it used to be easier, but "modern web design" demands all content be hidden) find out how it works, the web of trust, how it is definitely *you* who own and manage your keychain file. Actually, let me modify that: GPG is all in the open, PGP less so (getting corporate) and anything about digital signatures from Certain Big Corporations is - oh, look, pushing you towards keeping your keychain (not that they'll call it that) on their Cloud "for your convenience"...
> The passkey is generated on your device!
Okay. Let's assume that all these players are genuinely doing it properly (citation!). And the lack of trivially accessible documentation is just forgetfulness on their part (unlike, oooh, ssh -h). That all of these apparent webpages are totally benign as they create your private keys.Then:
> The ignorance on this site is astounding
How about you provide the references, at least to get us started.
* If they are locally generated, how do I generate one? Can they be securely generated by me, using demonstrably local commands?
* Where are they stored? How do I access my own set of private keys (e.g. keychain file)?
Etc etc
[1] Yes, yes, you'd hope that anyone on a techie site like El Reg would have looked up all this stuff, as something to fill the long Winter evenings, but - well, ref my opinion on how many here grok SSH.