Tesla should just implement support for passkeys. Since WebAuthn credentials are bound to the domain they are created for, they are strongly phishing resistant.

Tesla should just implement support for passkeys. Since WebAuthn credentials are bound to the domain they are created for, they are strongly phishing resistant. If you could login to the Tesla app with a passkey instead of password + TOTP, then a fake phishing site (on a different domain) would be unable able to steal people's Tesla account credentials.