7 ms·

Interesting, how about in the Passkeys scenario where you use biometrics?

• kevincox 2y ago
  It helps but isn't perfect. The attacker can't just pick up the secret. With a passkey they would need to trick you into touching it to authenticate them. Probably by timing it when you think you are about to do a regular authentication.
  • FreakLegion 2y ago
    Passkeys are the software version ('platform authenticator') of hardware keys ('roaming authenticator'), so no touching. Biometrics in this case are an attempt in software at something like the user presence test hardware has, but this is an OS-level guard, so the guarantees are much weaker. (Of course you can also have a biometric lock on a hardware key, which would be an improvement under the physical access threat model.)