Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
Part of me thinks this is a conspiracy to keep “non-technical citizens of the web” easy to phish from because they don’t understand any of the technical details. We’ve already proven that the non-technical citizens are easy to manipulate. This is basically just low-level social-engineering.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
How do you recover if you lose a passkey? By a link in an email sent to you?
These things are not safer than the weakest link in your chain. And not easier to recover than the hardest link in your chain. With a bit bad luck, you get something that is easy to hack, and impossible to recover.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
Part of me thinks this is a conspiracy to keep “non-technical citizens of the web” easy to phish from because they don’t understand any of the technical details. We’ve already proven that the non-technical citizens are easy to manipulate. This is basically just low-level social-engineering.
How do you recover if you lose a passkey? By a link in an email sent to you?
These things are not safer than the weakest link in your chain. And not easier to recover than the hardest link in your chain. With a bit bad luck, you get something that is easy to hack, and impossible to recover.
So, what is actually the threat model? And does it justify to take away user’s control over keys?