It would be nice to know if this was a misconfigured AWS S3 bucket.
My money would be on that.
Companies are still learning this lesson, slowly and at all of our expense.
Passkeys are half baked as implemented and rolled out by apple and Google.
Personally, I will never use them until apple and gooqgle can explain what the implications are across all their services and all my devices.
For example, say I switch to passkeys for my Google login. How do I login to YouTube on my Roku device?
If I buy into apple passkeys how do I log in to apple music on android?
The answer to the above will always be via passwords.
Personally I want one passkey for Google and one for apple on my yubikey and that's it and password backup for limited devices with password backup for login.
The author is correct that requiring the cloud is asking for tons of trouble, but people that say they have to dig yubikeys out of a drawer are not yubikey users. Yubikey users attach them to Keychains or wallets because they ACTUALLY use them and keep backups of them.
Personally, I think Apple's 2 factor is a joke and likely dangerous. I dont trust Google to not screw up passkeys either.