3 ms·
Totp is phishable. Passkeys aren't phishable. At the point where the user can access the private keys phishing is once again a concern. If I can't access my pk
by joshuamorton 3y ago
Totp is phishable. Passkeys aren't phishable. At the point where the user can access the private keys phishing is once again a concern.
If I can't access my pk, I cannot be phished. As soon as you allow me to copy my key (instead of creating many, which should be acceptable) I can be phished again.
- brnt 3y agoPasskeys are stealable no? If I have you phone...
- joshuamorton 3y agoYou still need my password or fingerprint to usea passkey, and can't transfer it from my device to yours.
- brnt 3y agoDoesn't sound a whole lot different from TOTP to me.
- joshuamorton 3y agoYou can't MITM a passkey, you can MITM a TOTP challenge. That is, passkeys cannot be phished. The only way to get into my passkey protected account is to physically gain access to my passkey device, which requires both physical access to the device, and a second factor like a face/fingperprint or PIN/password. Additionally, the TOTP secret can be copied, while today passkeys don't allow that either.