That’s tickling a part of my recollection, but I could be crossing wires.
I could have sworn webauthn had a component where the server also signed a challenge for proof of possession of their key.
There’s also the component where the server can assert that the device is of a certain type, from a certain providence, in a way that’s a lot harder to fake. Anyone worth their salt would also notice that the users IP address had gone very weird, and in fact all the addresses for every customer had gone weird and identical (automatically, since no one’s checking that obviously).
You’re still fundamentally correct, but it’s worth underscoring how massively you’d have needed to own their infrastructure for the passkeys to be compromised. :)
That’s tickling a part of my recollection, but I could be crossing wires.
I could have sworn webauthn had a component where the server also signed a challenge for proof of possession of their key.
There’s also the component where the server can assert that the device is of a certain type, from a certain providence, in a way that’s a lot harder to fake. Anyone worth their salt would also notice that the users IP address had gone very weird, and in fact all the addresses for every customer had gone weird and identical (automatically, since no one’s checking that obviously).
You’re still fundamentally correct, but it’s worth underscoring how massively you’d have needed to own their infrastructure for the passkeys to be compromised. :)