Re:Passkeys: A Shattered Dream
by kriops on Friday April 26, 2024 @08:46AM
(#40168779)
Most important feature imo: The effective "password" being sent over the wire is essentially some hash(secret, uri). Think about the consequences for phishing!
[ Parent
| on HN ]
Not true.
The signed assertion includes the clientDataJSON, which contains the origin of the relying party. Assuming the server properly validates that assertion, it should prevent the use of a phished assertion by a third party.
https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...