Comment by dewey
7 days ago
> Phishing isn’t a big threat to regular consumers.
Can you back that up with data? Anecdotally regular people get phished all the time, why do you think banks are sending out frequent reminders, show banners on their websites and apps about phishing attempts in the wild and mail providers explicitly showing if something is an official Google / Fastmail communication and when it's not.
When I see phishing mail they are always for banking, Google / iCloud accounts and not specifically targeted at "corporate" or government agencies.
You are describing a wider phenomenon better known as scams or social engineering, of which phishing is a subset. Phishing is defined as tricking the users into giving up their passwords. Passkeys by definition make phishing disappear because there is nothing to give up.
Banks are sending out frequent reminders because scammers are still out there. They pretend to be banks. But they don’t ask for your password anymore. They scare you into action to buy them a gift card. They tell you the IRS is coming after you or the bank is going to wire out all your money unless you listen to them. They tell you your computer is infected with a virus that will steal money unless you copy-paste a special command to kill the virus inside Windows Run. That’s not phishing. That’s not a problem solvable by passkeys.
> But they don’t ask for your password anymore.
Just because you haven't seen it, doesn't mean it's not happening. I'm getting a monthly email from my brokerage (IKBR) that literally says phishing:
> Our clients have seen a wave of “phishing” attempts in which scammers are impersonating Interactive Brokers. They send requests—sometimes by text, sometimes by email—for urgent updates of client information (often tax or other key information) and include login links pointing to websites that appear legitimate but are actually fake websites. If you click those links, you may inadvertently give bad actors access to your account.