Passkeys in a compromised account

1P_Blake- thank you for the reply

This is a decent enough reply, but it doesn't address 1Password's bizzare article where they claim to be taking all the steps and to always choose security.. but NOT to be implementing RASP techniques on Windows, where the protections are weakest and users most vulnerable.

Other than having to pay a 3rd party , the excuses around usability fall flat as these types of solutions are transparent (other than sometimes being flagged as malware).  1P_Blake , would 1Password consider making this at least an optional extra security measure/layer that Windows users could turn on to help make 1Password more resistant to malware that DOES happen to infect a PC?  I understand it's not perfect, but RASP mechanisms to protect applications do exist

Well, to some degree Windows offers lower inter-process protection and hardening than is available on other platforms like iOS/Android/MacOS.  1Password themselves even cites this.  They also cite that they could be doing in theory more programmatic hardening on windows but choose not to do the obfuscation because it sometimes makes things hard to debug (a bit of a cop-out IMO):  https://blog.1password.com/local-threats-device-protections/ 

The article sounds sane but then ends with some pretty air-headed contradictory commentary "When security restrictions clash with convenience and we have to make choices, we’ll always choose to give your secrets the best fighting chance."  -- Except they explicitly disclaim making this choice in the prior paragraph:

Runtime Application Self-Protection frameworks, for example, would allow us to make even root level attackers suffer. But these third-party products often have serious performance, reliability, and privacy considerations. The implications are serious enough that we’ve decided not to use them.

Translation:  We arn't experts in DRM and malware style obfuscation of code, and we don't want to pay someone else to do it, because that would cost money and make debugging hard. 

Such products exist and DO work to make attacker's lives hard, with relatively small or negligible performance hits most of the time.  The best of them do use more aggressive kernel drivers and such. Since they don't say what usability issues would be caused by using such tools, it feels like a bit of handwaving from a 1password on this product management perspective. Ultimately it could be compromised too, of course, but it's utterly ridiculous to then follow this up with we’ll always choose to give your secrets the best fighting chance, right after you've said that you made the opposite choice.