Comment by throwawayffffas
8 days ago
For their bank accounts, search tech support scam on youtube to see how that goes. Btw passkeys do nothing to stop this, they probably make it easier since grandpa doesn't have to search for a password or unlock a password manager to send his money to the scammers.
Convincing someone to log in to their bank and send you money is strictly harder than convincing someone to log in to their bank.
There is a middle ground where people are convinced to download a trojan and click ok once.
And if the bank implements the best form of Passkey (and implements it well) in this case it would require the user to biometrically authenticate before sending money (perhaps based on dollar amount or transaction volume) to a new account. The user would hopefully learn over time that the biometric requirement is aligned with money transfers and would grow suspicious if they were prompted for it during a scam session.
4 replies →
I'm not sure I follow this point? A trojan would fail to exfiltrate passkeys (assuming they're stored securely). It would be able to see a valid login and potentially use that session or exfiltrate the session, but wouldn't be able to get persistent account access. This seems better than stealing a password and getting persistent account access, or possibly stealing a TOTP code for the same. It's bad, but I think it's made better by passkeys? Unless I'm misunderstanding your point.
2 replies →