3 ms·

I think that we can easily say that it is a huge "epic fail" for the whole ecosystem of people that pushed for "Passkey" with the argument that "this was more s

• jiveturkey 2y ago
  I wouldn't dance on the grave yet.
• lxgr 2y ago
  It's worth keeping in mind that if you enter your password in an attacker-controlled website, you lose your entire credential, not just one malicious authentication/signature using it such as here. Also, this vulnerability is very patchable; password phishing is incredibly hard to prevent.
  • otterley 2y ago
    And, in fact, has already been patched in all major browsers.
• mastersplinter 2y ago
  Although this is an attack that can be carried out in practice, it is not quite as scalable as phishing passwords of potentially millions of users across the world. Passkeys are still in general more phish-proof than passwords.