Comment by aeternum
5 days ago
Phishing is even easier. Instead of "open your password manager, copy your password and paste it here" it becomes "your passkey is out of date, click here to enroll a new passkey. As part of this process a reset link will be sent to your email and code to your phone. Do not share the code with anyone."
This ^. It introduces MORE layers to phish. More external 'trust me'.
ESPECIALLY when seemingly no one actually knows how passkeys actually work.
If your account is already not protected by passkeys (it has access to traditional username + password credentials), it can be phished regardless.. in those cases you just need to send them a traditional "reset password" phishing email.
The point is that those attacks would be (nearly) impossible if you have a truly passwordless system.
Yep, just look at the FBI alert of signal accounts being hacked. This is the same "vulnerability" that syncing passkey will have.