36
Passkeys are not a trap. Use them! (hachyderm.io)
submitted 2 weeks ago by to c/linux@lemmy.ml
29 comments fedilink hide all child comments
 

Crossposted from https://feddit.org/post/36692057

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 2 weeks ago (3 children)

I see. I use a password manager so it would probably not fill in the password or the TOTP and throw a red flag for me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 weeks ago

    The phishing attack could also try to convince you your bank had changed domains (hey we've been bought by Big Bank and will be moving your account to BigBank.com) and therefore not to expect your password manager to autofill (this is a stretch I know).

    Passkeys are resistant to phishing as they cannot be replayed and your authenticator should refuse challenges from the wrong domain. Even if it did solve a challenge from bigbank.com it's worthless as the origin is included in the returned challenge so cannot be used by the attackers on the real bank site.

  • permalink
  • fedilink
  • source
  • parent