4 ms·
The involved engineers are most likely running around with a blushed-red face to this day, claiming "phishing resistance" in all the marketing materials but the
by bflesch 2y ago
The involved engineers are most likely running around with a blushed-red face to this day, claiming "phishing resistance" in all the marketing materials but then having such a bug. I'd say the cover-your-ass (CYA) reflex was a big incentive for google engineers to fix it quickly.
- lxgr 2y agoPhishing resistance isn't a binary property, it's a spectrum, and even with this vulnerability, that of passkeys is orders of magnitude higher than that of most other alternatives (including passwords, SMS OTP, TOTP etc.)
- acdha 2y agoThis attack requires physical presence and visiting an attacker-controlled page. It’s absolutely a real threat and great work, but there are multiple orders of magnitude more people getting phished using weak MFA than by an attacker with control of a BLE device in their home or office.