Would love for you to describe exactly how it’s more complicated.

YOU JUST DID, below

From my perspective

neat.

I click a single button

... on your device tethered to a single app by a single vendor and their closed data store

and it’s set up.

... and tethered to prevent you from churning.

To log in I

... wait online to ...

get a notification on my device,

... or send it again. Or again. Try again. Maybe mail it?

I click a button and I’m logged in.

Yeah. Just click (tap) a button (enter a code).

Using a big-brand MFA setup at one job that requires 'one button' and 'get a notification' and 'click a button', I know you're glossing over the network issues HEAV-I-LY.

Now do it in airplane mode. Do it when the token organization is offline. Do it when there's no power because the hurricane hit and there's no cell, no data, no phones, and your DC is on its last hour of battery and you have to log in because the failover didn't run.

Do it when your phone fell on its face in the rain into a puddle and it's not nokia.

Do it when you either have cell service and 5% battery, or 100% battery from inside the DC and no cell service.

Do it when you're tired, hungry, drunk, lost your glasses in the car accident.

The D in DR means DISASTER. Consider it.

they must have meant technically complicated, which is also meaningful in consumer technology.
like if it's true that it requires an internet connection, that's quite bad, partly because of yet another avenue for possible tracking, and what if the service you want to access is not on the internet, but the passkey doesn't work without it still

Would love for you to describe exactly how it’s more complicated.

"More" is relative, ofc, so YMMV on whether you agree with me or not on this.

But the problem with pass key is that it has all of the downsides of 2FA still -- you need to use a mobile device such as a cell phone, that cell phone must be connected to the internet and you often can't register a single account to multiple devices (as in, there's only ever 1 device that has passkey authorization.)

This isn't an issue with ssh keys, which is a superior design despite it not being native to the web browsing experience. SSH keys can be added or removed to an account for any number of devices as long as you have some kind of login access. You can generally use SSH keys on any device regardless of network connection. There's no security flaws to SSH keys because the public key is all that is held by 3rd parties, and it's up to the user in question to ensure they keep good control over their keys.

Keys can be assigned to a password and don't require you to use biometrics as the only authentication system.

I feel like there's probably more here, but all of this adds up to a more complicated experience IMO. But again, it's all relative. If you only ever use password + 2fa, I will give them that it's simpler than this (even though, from the backend side of things, it's MUCH more complicated from what I hear.)