3 ms·
The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in somethi
by josephcsible 1y ago
The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in something like a YubiKey, because once you log in to your bank with your hardware-backed passkey, the malware on your computer could use the session you started to transfer all of your money out of your account.
- ngrilly 1y agoThat’s why most banks ask you to approve transactions with an explicit reauthentication.
- josephcsible 1y agoThen the malware will just wait until you want to do something legitimate that needs that, and then swap it out for its own thing.
- wbl 1y agoBut it can't maintain that compromise. That's important.