Tootfinder

@… security theory question: is a #passkey rather a something you know or a something you have? In terms of MFA? I see different orgs that treat it either this way or that way. Any opinion or maybe even hard fact?