1 post
Passkeys defeat credential phishing but not session hijacking. How token replay, passkey enrollment, and weak recovery bypass phishing-resistant MFA.
