> Codebook links passwords to specific websites/RPs. WebAuthn is different: 1. The client (browser) knows which site is requesting credentials, which means a

> Codebook links passwords to specific websites/RPs. WebAuthn is different: 1. The client (browser) knows which site is requesting credentials, which means a phishing site cannot ask for another legitimate site's credentials 2. Credentials are created as private keys and unique per-site. 3. The authentication protocol does not share secrets; it is based on public/private keys. 4. The authentication protocol involved indicates the requesting origin. There are still vulnerabilities if you have compromised DNS or javascript on the site, but it is overall significantly stronger against phishing and credential reuse attacks than password managers could provide before - even those with browser integration.