aleksejs 21 minutes ago | parent | next [-]

The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:

> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.

The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.

▲

MBCook an hour ago | parent | prev [-]

Isn’t that a bug in the Microsoft software, not the pass key specification?

▲

autoexec an hour ago | parent [-]

That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank and some random web form with their banks logo slapped on it created on wix.com

Several of the successful attacks that compromised passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.

Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.

	▲	MBCook 10 minutes ago \| parent [-]
		But every single one of those attacks has also existed for classic password managers. It’s not a new vulnerability. It’s not a reason to roll out Passkeys unless it’s also a reason to get rid of passwords. With Passkeys you’re still net ahead.