4 ms·
I thought that passkeys were domain-bound through a challenge response mechanism? That should completely prevent fishing of this simple MitM the 2nd factor. At
by rocqua 2y ago
I thought that passkeys were domain-bound through a challenge response mechanism?
That should completely prevent fishing of this simple MitM the 2nd factor. At least, that's how I've seen it be sold.
- fc417fc802 2y agoYes. So when it prevents the phishing attempt there's a good chance that quite a few people will assume something broke and attempt an alternative login method - with the phishing "service".