Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless?
Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article.
Now say my passkey is compromised, and an attacker logs in from somewhere else. Won't the signCount just be incremented and synchronised with the smartphone and the laptop? How does signCount prevent that?
Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article.
Now say my passkey is compromised, and an attacker logs in from somewhere else. Won't the signCount just be incremented and synchronised with the smartphone and the laptop? How does signCount prevent that?