Tootfinder

Mit #PassTaKey wurden 3 schwere Sicherheitslücken in Verbindung mit #Google #Chrome und #Passkeys veröffentlicht, die u…

I think this is misguided advice. The attestation worry is real and worth fighting, but "use TOTP instead" is bad advice. TOTP codes get phished daily; passkeys are domain-bound, so phishing kits can't relay them. Also, WebAuthn is a W3C standard, synced passkeys (Apple, Google, 1Password, Bitwarden, KeePassXC) don't send attestation, and the author's own pick, YubiKeys, do.
Fight attestation mandates. Keep the passkeys. Also, substack is a lame platform for not being activepub compliant.
#passkeys #infosec