@rmondello @staff the phishing isn't for passwords, it's for credit card details (and the forms are very believable looking & have been for a number of different payment processors).
So unless a passkey can replace a credit card, it's not really a solution
iirc, requiring 2FA is coming as an option, however the compromised accounts look like accounts that wouldn't bother with 2FA (based on the data I have available), so they probably wouldn't bother with passkeys either unless passkeys were the only authentication mechanism, and well, that's a terrible idea for a variety of reasons, and would disproportionately affect marginalized people
The less the browser can tell the user about the identity of the person (or organization) responsible for the website, the bigger the risks for the user when supplying personal information, credit card details or creating an account (passkeys, which have other disadvantages, are indeed useless in such cases).
More info in this thread: https://infosec.exchange/@ErikvanStraten/114886335722813414 (or ask me to elaborate again).
A space for Bonfire maintainers and contributors to communicate
