The site is actually asking me for login now via Google or something else. In recent times, many sites like Howtogeek or MakeUseOf have kinda paywalled unless you login. It works properly with adblocker (uBlock Origin) once I login though.
The point is its a shitty thing to do and I would rather not give them any attention especially since the entire thing is explained in a blog post on bitwardens site.
And if you only need FIDO2/passkeys, the Security Key series is half the cost ($25) of the Yubikey 5 ($50) and all you really lose is OpenPGP and PIV (smart card) functionality.
Now I like playing with all the features of the 5, but most people should just need FIDO2.
I looked into this a year ago and most sites did not offer to register a second key, so if you lose your key, you can kiss many of your accesses goodbye. I would never have the key to my digital life on a keychain... The idea is good, but it will cause huge damage if you lose your HW key. On the other hand, if you are cautious and use different PWs and a password manager with 2FA, you are quite safe.
I have had three of them on my keyring for years (one old personal, one newer personal and one for work) and even though they sometimes get lodged between the keys and a separate ring I have on the main ring none of them ever even got close to looking damaged (excluding some mild fading of the print on the oldest one).
Passkeys are like a password + 2FA mashed together. If someone steals your "passkey password" they still can't use it to login without the hardware component. That means phishing is harder. Since passkeys are generated for the user from their hardware it also forces better hygiene on the user by not allowig any password duplication.
A downside is it is tied to hardware and a provider that can cause problems witb loss of device or when you change devices but it is hard to say how painful that is going to be.
When you visit a website you'd like to login to, your browser generates a public/private key pair and gives the public key to the site.
When you want to login:
The browser uses the website domain name to generate a challenge and sends it to the website.
The website verifies the challenge by sending back a randomly generated long text, encrypted with the public key.
Browser confirms by sending back the decrypted text as proof.
Now both website and browser are sure the other is legit, there are no passwords involved, the login process is standardized and can be upgraded with new protocols and cyphers whenever needed, you can't be phished, you can't be tricked by a fake domain that looks in Unicode like the correct one, and if anybody breaks in and steals the public key they can't do anything with it.
The main advantage is that, like hardware security keys, they're immune to Man in the Middle phishing attacks, but are far simpler to use so should hopefully see much more widespread use.