Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.

Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.

  • trevorEnglish
    3•4 days ago

    Okay, so it’s just like Yubikey-type stuff? I’ve thought about that before but it seems very risky - they recommend you get two and set both of them up so you have a backup, but that would require all websites to support that, right?

    Pretty much. I suppose that’s a very real disadvantage to using physical passkeys. If you lose it, unless you have multiple passkeys configured, or have access to an account recovery method, you lose that account.

    But, like you mentioned, using Bitwarden would sidestep that issue, and they do support passkey emulation.