News for hackers. Stuff that matters.

A comment on DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware. Parent comment

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Wednesday September 10, 2025 @07:51PM (#45205783)
With passkeys there is nothing to check manually. If it works, you know it's the domain you registered on. If it doesn't work, you log in with a non-phishable auth method like emailed magic link, then register a new passkey.

You could claim that a phishing site could set up their own passkey registration system–but that still wouldn't give them access to the target's real account.

[ Parent | on HN ]
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by diggan on Thursday September 11, 2025 @02:56AM (#45208622)
> With passkeys there is nothing to check manually. If it works, you know it's the domain you registered on. If it doesn't work,

So exactly the same as password managers, there is no functional difference if you were using a password manager...

[ Parent | on HN ]