Hacker News Reader

Yes, and that's also true for SMS messages and your passwords. That is why having MFA is important.

You can't intercept a passkey in the same way.

It is also far less likely to be phished, and there is nothing transmitted.

TOTP is the modern WPA2 of security - it's just not good enough when better alternatives exist.

What kind of risk profile does one have when it is likely that both the password is known and malware has been installed on the phone, but also just access to an ephemeral login session by the attacker (which could be obtained even when using a secure enclave by waiting for the user to authenticate by themselves) would not be enough?

> password is known

What password?

Reply on news.ycombinator.com