I am not sure I completely understand.
> so a Yubikey passkey is very quickly a single-point-of-failure
It is a single point of failure when there is one. As soon as you use two, then it's not a single point a failure anymore, is it?
The counter argument I usually read is: "Yeah but it is not practical, because you need 3 yubikeys: the first 2 with you, that you enroll everywhere, and one in a safe. And every time you add a new passkey, you need to go get the one in the safe, replace it by another one, and enroll the one of the safe. You can't spend your life driving between your desk and your safe".
But I have been using multiple Yubikeys for... 8 years now I think? I don't remember the last time I enrolled and important key. Sure, once in a while I add a website, and it is a bit annoying to have to enroll the other Yubikeys at a different time. But it really doesn't happen that often, and anyway most of those websites allow me to recover my account with my email. So it is actually practical to have a "convenience yubikey" for websites that don't matter so much, and in case this Yubikey dies... well those websites were not so important, and anyway I can recover from my email.
The difference for the important websites (and really, I don't think I have really important websites in my life that don't allow me to recover by going in person with my ID, but for the sake of the argument) is that I actually do have multiple Yubikeys, one of which is stored away.
Whereas the master password of my Bitwarden account is a single point of failure, and the security of my online Bitwarden account is as well.
> so a Yubikey passkey is very quickly a single-point-of-failure
It is a single point of failure when there is one. As soon as you use two, then it's not a single point a failure anymore, is it?
The counter argument I usually read is: "Yeah but it is not practical, because you need 3 yubikeys: the first 2 with you, that you enroll everywhere, and one in a safe. And every time you add a new passkey, you need to go get the one in the safe, replace it by another one, and enroll the one of the safe. You can't spend your life driving between your desk and your safe".
But I have been using multiple Yubikeys for... 8 years now I think? I don't remember the last time I enrolled and important key. Sure, once in a while I add a website, and it is a bit annoying to have to enroll the other Yubikeys at a different time. But it really doesn't happen that often, and anyway most of those websites allow me to recover my account with my email. So it is actually practical to have a "convenience yubikey" for websites that don't matter so much, and in case this Yubikey dies... well those websites were not so important, and anyway I can recover from my email.
The difference for the important websites (and really, I don't think I have really important websites in my life that don't allow me to recover by going in person with my ID, but for the sake of the argument) is that I actually do have multiple Yubikeys, one of which is stored away.
Whereas the master password of my Bitwarden account is a single point of failure, and the security of my online Bitwarden account is as well.