[legitster]

I think about this a lot when using our corporate SSO tool.

When I hit the button to log into Slack, there are like, 3 popups in succession - the last one ultimately asking for my fingerprint. Then when I give it, there is a flurry of web pages that get loaded and redirects that happen until finally Slack pops up again.

There isn't any realistic world in which I check each window to make sure everything is happening right and I am not being MitM'd.

I'm a fairly technical person, and I would be unable to perceive the difference between a really tight security environment and my computer being hijacked.

[jerednel]

Aren’t passkeys intrinsically resistant to those attacks? With hardware security keys, the private key remains on the device, never crosses the network, and is cryptographically bound to the site being authenticated.

[joshuamorton]

The point of passkeys is that you don't need to. Unlike passwords, your session cannot be hijacked because the thing that you give your fingerprint cryptographically verified the requester.