Comment Comment by konha They can be. Depends on how the are implemented.Passkeys can:- Replace the whole login (including discovery of the user id)- Just replace the password, after a user specified a user id- Be used as a second factor just like TOTPThey are definitely more phishing resistant for what it’s worth, even if just used for MFA. TOTP codes can be copied manually by an unsuspecting user. parent konha 2 years ago
Passkeys can:
- Replace the whole login (including discovery of the user id)
- Just replace the password, after a user specified a user id
- Be used as a second factor just like TOTP
They are definitely more phishing resistant for what it’s worth, even if just used for MFA. TOTP codes can be copied manually by an unsuspecting user.