9 ms·
They can be. Depends on how the are implemented. Passkeys can: - Replace the whole login (including discovery of the user id) - Just replace the password, af
by konha 2y ago
They can be. Depends on how the are implemented.
Passkeys can:
- Replace the whole login (including discovery of the user id)
- Just replace the password, after a user specified a user id
- Be used as a second factor just like TOTP
They are definitely more phishing resistant for what it’s worth, even if just used for MFA. TOTP codes can be copied manually by an unsuspecting user.
- Raed667 2y agoThanks for the clarification! Do you know if any services that implemented the full flow including the discovery of user id ?
- mderazon 2y agoGitHub
- ecesena 2y agoSee also: https://webauthn.io https://webauthn.io If you want to explore more options.
- stpn 2y agoWe do this for https://tender.run https://tender.run - the feature is called conditional mediation / ui. I found this article[0] helpful for implementation. [0]: https://web.dev/articles/passkey-form-autofill#fetch_a_challenge_from_the_rp_server https://web.dev/articles/passkey-form-autofill#fetch_a_chall...