0

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It would be like a website requiring only the code from Authenticator and no password.

This is certainly more convenient, but it seems that convenience is the only benefit. Indeed it lowers security since if my phone is lost and someone manages to get into it they would then have access to all my accounts protected by the passkey.

Have I understood this correctly? If so is convenience really considered worth the reduction in security? Or is it considered that a decent PIN on the phone should delay attackers long enough for me to cancel the passkey and therefore that any reduction in security is minimal?

2

1 Answer 1

2

One of the key differences is the level of protection you get from phishing attacks.

If you end up clicking a link to paypa1.com and enter your username/password and OTP into it, an attacker can use those to login to the real paypal.com as long as they're quick enough. But that wouldn't work with passkeys - so the attacker wouldn't get access to your account.

1
  • Because with a typical passkey app you just click on an Allow button instead of getting a PIN to type in? Dec 27, 2023 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .