> How can my smartphone know whether I'm interacting with the correct website on my laptop? Because when evil.example requests the passkey it has to do so thro

> How can my smartphone know whether I'm interacting with the correct website on my laptop? Because when evil.example requests the passkey it has to do so through browser APIs [1], and it can't lie about its domain name. Your browser is what reaches out to your phone, which is how your phone learns what domain you are actually on. [1] https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/ In this case your phone wouldn't even show you your passkeys from good.example.