aleksejs

Right, if you phish the credentials to an account that is not protected by a passkey, one thing you can now do is set up your own passkey on it. That's exactly what passkeys would've protected the victim against!

The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.

The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:

> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.

The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.

> The obvious way to satisfy people is to remove support for remote attestation from the spec.

If you presume bad faith on the part of basically the entire WebAuthn implementer community, how does this help?

The consumer passkey authenticator implementations of today do not provide attestations, passkey relying parties do not consume them, and both would need to intentionally ship changes to enact the scenario you're worried about. If you're worried about both of these colluding to lock you out of your accounts, it seems naive to think that changes to an (intentionally malleable, extensible) spec will protect you.

> re-enroll attacker's key or register attacker's passkey

Can you walk me through how that would work?

That's an odd point to make when in the actual world we live in, Cambridge was where the first COVID vaccine was developed.

I really like the _idea_ of a QWERTY phone, and halfway through this page there's a section showing how you can use special characters to invoke commands (presumably by just typing at the home screen?), like "- buy milk" to add a todo entry or "? aviation recipe" to search. This sounds great, and somewhat difficult to replicate on a touchscreen!

But I'm not convinced anymore that the actual typing experience is any good. Way before that exciting section, there's a video where somebody takes two full seconds to type "Hey bro you" on this phone's keyboard. I tried: in the same amount of time, I can type "Hey bro you mean everything to me" on my Pixel's default keyboard.

Fascinating times we live in, when "the last hypervisor bug" in what is presumably one of the most hardened pieces of consumer hardware can be found by "noobs" and "slop kiddies".

Allegheny County in Pennsylvania is one such department without a separate number. I don't think it's that uncommon.

Is your heat sink entirely unmodified? Opening up the fins should make it a lot easier to cool.

Meta glasses do have a recording indicator.

You will surely not have a good time enforcing the terms of a legal document that explicitly spells out that it is intentionally obfuscated from the party it intends to bind.

I think the actor they were monitoring was not tracking real launches but rather simulating where a hypothetical balloon launched from their territory would land.