> The vendors claim that this is to make phishing impossible They do? I don't see how, since non-discoverable WebAuthN credentials make phishing just as imposs

> The vendors claim that this is to make phishing impossible They do? I don't see how, since non-discoverable WebAuthN credentials make phishing just as impossible. The only thing discoverable credentials allow on top of non-discoverable ones is avoiding having the user type in their username or email address.