There is security value. A passkey will not work anywhere except the actual website. Fake look a like sites can't get the credentials. Evidently they can trick you into authorizing their device.

▲

harshreality 2 days ago | parent | next [-]

That's also how any good password manager works. You'd have to manually copy-paste the password to get around the same-site fill restriction (whether it's autofill or manual fill).

	▲	zdp7 2 days ago \| parent [-]
		Passkeys have an advantage in that the server doesn't have your password and every passkey should be unique.

▲

thyristan 2 days ago | parent | prev [-]

Sure? MitM isn't a new kind of attack, and I'd be surprised if the ball-of-wax-and-javascript that is WebAuthn isn't vulnerable to that...

	▲	zdp7 2 days ago \| parent [-]
		This is one of the key security features of passkeys. I did a little searching and the work around is to do a standard fake website that prompts for your standard credentials. That should be a fairly simple fix. Require access from a new device to be authorized from another source with an explanation that they will never request this info.