Remind me, who owns WhatsApp?

Passkeys (depending on implementation) are more resistant to info stealer viruses.

The private key portion can be in your OS’s credential store and can be used to sign the challenge without being revealed to the calling application.

Of course this doesn’t work if you got rooted, but a lot of viruses of this kind try to steal what they can get as a regular user, and you can get a lot, ie AWS credentials, saved browser passwords etc.

In my view it’s cheap defense in depth.

And no mention of what happens to their API but knowing google it either goes away entirely or totally changes with significant rework required.

Related, the reason I no longer use any google API: https://steve-yegge.medium.com/dear-google-cloud-your-deprecation-policy-is-killing-you-ee7525dc05dc