4 ms·
How exactly do you get someone to give their passkey private key to a bad actor?
by bastawhiz 2y ago
How exactly do you get someone to give their passkey private key to a bad actor?
- scherlock 2y ago"Hi, this is Bob from blah support, we need to confirm your account is a correct. When prompted please confirm to give us access". if someone is dumb enough to hand out a password, they are dumb enough to click approve. Phishing is a social attack, not a technical attack.
- tadfisher 2y agoYour passkey provider will simply refuse to show that it has a credential for Bob's phishing convincing phishing site. RP challenges are bound to a domain for this purpose.
- bastawhiz 2y agoYour browser won't auth you with a key meant for a site you're not on. There's no mechanism for what you're describing.