Ah thanks for clarifying. I didn't know that Webauthn did that. I had planned to read up in it in detail but at work it has been ruled out for implementation fo

Ah thanks for clarifying. I didn't know that Webauthn did that. I had planned to read up in it in detail but at work it has been ruled out for implementation for the next months so it didn't have priority :) I really appreciate the breakdown of how it works! I agree this makes phishing almost impossible (at least without obtaining a valid cert which is in itself really hard for a non state actor)