That’s what bugs me about passwordless. It’s just 1fa again, except that the password is still there to sign in from other devices if you don’t have a passkey set up yet, so now you have more than one attack vector.
Passkeys and Totp codes in my password manager make no fucking sense to me. And whoever is pushing passkeys as the new default needs to get a hard slap in the face, they’ve clearly never dealt with end users or my mom.
That’s what bugs me about passwordless. It’s just 1fa again, except that the password is still there to sign in from other devices if you don’t have a passkey set up yet, so now you have more than one attack vector.
Passkeys and Totp codes in my password manager make no fucking sense to me. And whoever is pushing passkeys as the new default needs to get a hard slap in the face, they’ve clearly never dealt with end users or my mom.