A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

I feel like this is a really strong justification for duress passwords. Register a duress password with your phone or bank account, and if you ever enter it, that system will take whatever actions you want - call the police with your location, display a fake balance of a few hundred dollars, switch to a fake email account, hide your crypto wallet app, whatever.

FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.

> More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken.

You are describing the current status quo, without passkeys. This is already possible.

Well, except maybe for the "without recourse" part, because there are some legal and policy avenues available for dealing with this situation.

Exactly. The only financial stuff on my phone is Google Wallet and I don't even live in a high threat area. The devices that can accept payment from Google Wallet are always in observed locations, it would be very hard for a mugger to use it maliciously. All the easy money transfer options are an attack surface I see no need to expose.

> whereas with passwords I can just log into Bitwarden wherever and I'm golden

Good luck. For some arcane reason, Bitwarden turned on email-based 2FA for my account last night and all of a sudden I'm locked out of my account for half a day. …mostly because I have greylisting enabled on my mail server, so emails don't arrive right away, but as it so happens I also had all my hardware stolen from me last weekend. Bootstrap is a real bitch.