On: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

[jesseendahl]

Majority of second factors are phishable. If you are using a password (phishable) + a phishable second factor (any kind of 6 digit code that you need to type or paste into a text box), you are less secure than if you were using only a passkey.