4 ms·
You still need my password or fingerprint to usea passkey, and can't transfer it from my device to yours.
by joshuamorton 3y ago
You still need my password or fingerprint to usea passkey, and can't transfer it from my device to yours.
- brnt 3y agoDoesn't sound a whole lot different from TOTP to me.
- joshuamorton 3y agoYou can't MITM a passkey, you can MITM a TOTP challenge. That is, passkeys cannot be phished. The only way to get into my passkey protected account is to physically gain access to my passkey device, which requires both physical access to the device, and a second factor like a face/fingperprint or PIN/password. Additionally, the TOTP secret can be copied, while today passkeys don't allow that either.