Comment by timmyc123
5 days ago
The primary reason 2FA exists is because passwords are phishable. If you remove passwords, the need for 2FA largely disappears.
5 days ago
The primary reason 2FA exists is because passwords are phishable. If you remove passwords, the need for 2FA largely disappears.
2FA exists because defense in depth. Even if passwords weren't phishable, it can still be handy to defense in depth that a person is who they say they are by checking multiple factors ("something you know", "something you are", "something you have").
Passkeys largely meet 2FA requirements by themselves because they are "something you have" (its stored on a device you own) and require "something you know" (device PIN) or "something you are" (biometric unlock) to use.
I would say its something you have when it’s hardware backed, including secure enclave/pin/face id, but a cloud sync’d password manager isn’t necessarily that, though, again still a better situation than a phished password.
It's still not quite something you know or you are, so it is a different factor, even if we can quibble on if it is more weakly "something you have" when not hardware specific.
It moves the attack surface to password managers, which is arguably a better situation than phishing. I'm skeptical that the war is over, though. I have no proof to back this up as phishing is the low-hanging fruit today, so the numbers 'largely' back you up. I personally include device compromise in my threat model and I'll concede that may be overdoing it for the average person.