Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.
-2 points
I haven’t either because I don’t see the advantage. Cases like this show that there may not be any.
6 points
Cases like this only prove that a better lock doesn’t improve security when the old lock still lets you in.
The takeaway here isn’t “passkeys are bad”, it’s “keeping less secure methods of authentication as a fallback is bad”
It’s like saying all 2FA is bad because SMS 2FA is dogshit.
2 points
