What is 'passwordless authentication via passkeys' and what underlying standard does it use?

• A.Passkeys use email magic links stored in a cloud service instead of passwords
• B.Passkeys are SMS-based tokens that use a phone number as the second factor; step-up authentication is a server restart that forces every session to re-authenticate simultaneously; bearer tokens are safe in URLs because RFC 6750 requires proxies to redact the access_token query parameter from logs; device-bound passkeys sync through the password's own hash, and resetting the password revokes every passkey; consent screens in OAuth are optional for scopes below read-write, which the protocol auto-grants silently; bcrypt is unsuitable for passwords because it is too fast, making single-round SHA-256 the slower, safer choice
• C.Passkeys are hardware tokens (like YubiKey) that must be physically purchased and provisioned; session cookies for authentication must be readable by JavaScript for the logout button to be able to clear them; unlimited login attempts are the industry standard, since any lockout policy converts stuffing into denial of service; hashing passwords client-side before transmission removes the need for TLS on the login endpoint; auth cookies and bearer tokens carry identical CSRF exposure, since browsers attach Authorization headers automatically to form posts; SAML response signatures cover the envelope only, and individual assertions are validated by the IdP rather than the SP