It requires a PIN to give a resident key, and too many pin failures wipes it.
Other authenticators have biometric requirements.
Re:Passkeys: A Shattered Dream
by abdullahkhalids on Friday April 26, 2024 @02:48PM
(#40172843)
I see. So the weakest link in the security chain is that someone discovers the <6 digit pin on your usb key (easy on a security camera), and then manages to steal it for 2 min.
Not terrible for anyone whose threat model is not targeted attacks. But quite bad for people whose threat model is exactly that.
What allows you to tap your token on your phone and register a passkey-stored-on-phone registered with TotallyCoolService? Did you previously set your phone and token to be "mutually trusted devices" in some way?
Or what's preventing a thief from tapping my token on their phone to register it on TotallyCoolService?