On: Passkeys are not a trap

[MBCook]

Correct. The hash effectively is the password at that point.

If you’re storing the hash unencrypted in the DB, and it’s “just” a hash so why not, you’ve gone backwards.