News for hackers. Stuff that matters.

A comment on Passkeys are just passwords that require a password manager. Parent comment

Re:Passkeys are just passwords that require a password manager by crote on Tuesday August 05, 2025 @02:10AM (#44794810)
The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token.

Push notification based 2FA can never obtain that level of security.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Afty on Tuesday August 05, 2025 @12:53PM (#44800594)
What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?
[ Parent | on HN ]