PASSKEYS: THREAT MODELING AND IMPLEMENTATION CONSIDERATIONS

Summary from the TLDR InfoSec newsletter

This post begins with an overview of what passkeys are and how they work. The post then discusses threat models around phishing, stolen credentials, and MFA as they relate to passkeys. It concludes with a warning not to implement WebAuthn manually before providing some implementation considerations for passkeys.