The passkey is worse
Summary
The article recounts a real-world phishing incident that progressed through a fake Google login, a deceptive passkey prompt, and a compromised account, highlighting risks in passkey workflows and attacker capabilities. It also shares practical steps to mitigate damage and reflections on defense strategies, such as separated emails and security posture.