3 ms·
Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff
by jf 2y ago
Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff"?
- gavinhoward 2y agoFrom the first, no. It does handle the second and third, IIRC.
- lima 2y agoIt doesn't handle these either - what stops the user from entering their password on an attacker-controlled phishing page? Passkeys work because the user can't be tricked into entering their private key on a phishing website.
- gavinhoward 2y agoBrowsers could help with this. They just don't.