291
Google will now make passkeys the default for personal accounts
(arstechnica.com)
This is a most excellent place for technology news and articles.
The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it's replay protected so for example an XSS attack lasts only for one session, so it's more robust.
Correct, but that doesn’t change the fact that “Passkeys can’t be phished” is not true.