2026-10-14 03:10 UTC
Is TOTP always phishable? Like the phisher says “tell me the code in your authenticator app”? But can’t say “tell me your passkey?”
Replies (3)
-
@lone_faerie@lemmy.blahaj.zone 2026-10-14 03:34
Phishing isn’t just over the phone. A phishing website that’s imitating say a bank website is just as easy to get the TOTP than it is the password.
-
@libewa@feddit.org 2026-10-14 07:27
Nobody is (should be) stopping you from enrolling all your devices, and synced passkeys (e.g. iCloud Keyring) are part of the spec.
-
@bad1080@piefed.social 2026-10-14 11:23
imo the problem isn’t how you authenticate yourself but how anybody with that cookie is now verified as you