Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.
Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.
Cases like this only prove that a better lock doesn’t improve security when the old lock still lets you in.
The takeaway here isn’t “passkeys are bad”, it’s “keeping less secure methods of authentication as a fallback is bad”
It’s like saying all 2FA is bad because SMS 2FA is dogshit.
This is the real takeaway, if you have a forgot password button that bypasses everything then none of it is anything more than a login accelerator.