How it works:

In case of https://fake-bank.com instead of https://bank.com (where you have a passkey for):

1️⃣ In your browser you open https://fake-bank.com
2️⃣ Your browser asks your passkey manager: do you have one or more passkeys for https://fake-bank.com?
3️⃣ The passkey manager replies: no

NO ASYMMETRIC CRYPTOGRAPHY RELATED TO PASSKEYS INVOLVED

🚨 When things get complicated (very rare cases)

1️⃣ Phishing mail: check your GMail account at https://sites.google.com/niceguy which you open in your browser
2️⃣ The site asks you to log in using your google account
3️⃣ Since you have a passkey for https://google.com, your passkey manager will sign the request using your passkey's private key. The signed data will include the full domain name: https://sites.google.com
4️⃣ Google is aware of this risk (see https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580) which is why it does not let you log in.

🚨 When things get complicated AND FAIL

🔴 A hijacked domain name gets a certificate (this: https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/ won't protect you). This will not prevent a passkey-login (if the fake site acts as AitM).

🔴 Subdomain hijacking where the main domain does NOT check the full DN in the signed data.

@soatok

#passkeys #CryptoBS

How Dips**t Grifters Are Scamming You - Long Story Short | The Daily Show

This isn't just the "golden age of grifters," it's the age of dips**t grifters. Hasan Minhaj dives into the idiocy of modern-day financial scam artists and proposes a solution: rampant snitching. #DailyShow #Comedy Subscribe to The Daily Show: https://www.youtube.com/channel/UCwWhs_6x42TyRM4Wstoq8HA/?sub_confirmation=1 Follow The Daily Show: Twitter: https://twitter.com/TheDailyShow Facebook: https://www.facebook.com/thedailyshow Instagram: https://www.instagram.com/thedailyshow Stream full episodes of The Daily Show on Paramount+: http://www.paramountplus.com/?ftag=PPM-05-10aei0b Follow Comedy Central: Twitter: https://twitter.com/ComedyCentral Facebook: https://www.facebook.com/ComedyCentral Instagram: https://www.instagram.com/comedycentral Watch full episodes of The Daily Show: https://www.cc.com/shows/the-daily-show About The Daily Show: For over twenty-five years, the groundbreaking, Emmy and Peabody award-winning The Daily Show has entertained audiences each night with hilarious, provocative and insightful satire about our society that helps make sense of the world. The Daily Show redefined the late night show category on TV and, with an audience of over 44M across social media platforms, has become a launching pad for some of the biggest stars in entertainment. This next chapter of this iconic franchise showcases its diverse news team of correspondents and contributors, including Ronny Chieng, Michael Kosta, Desi Lydic, Dulcé Sloan, Roy Wood Jr., Lewis Black and Jordan Klepper, comedy greats as guests hosts, and interviews with influential and emerging voices from across society. The Daily Show airs weeknights at 11/10c on Comedy Central.

The Daily Show | Invidious