More of the websites that support our store's critical processes – now including PayPal and the government sites where we pay taxes – are requiring the use of passkeys. Apparently this is being driven by AI-enabled attacks on the 2FA we used in the past.

So far, I've been storing those passkeys on my Android phone – mainly because Google's process for transitioning accounts to a new phone has always been very easy. I've avoided storing passkeys on my desktop PC because of the nightmares we've always had when upgrading Windows hardware.

So now when I log on to those sites from my office PC, I must enable a Bluetooth connection on that PC, to authenticate with a fingerprint on my phone.

Is this the right way to go?

I'd appreciate any comments about best practices to avoid problems in the future.