alt Hacker NewsDid you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey.
No major bank revokes your password when you setup a passkey, either.
Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey.
No major bank revokes your password when you setup a passkey, either.
Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such.
As to
> No major bank revokes your password when you setup a passkey, either.
If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that depends on the country. It's the status-quo in some places. Some banks even put the input field for the token output as a third input in the login form on their website because all customers have them. The rest separate their login form in multiple steps, but they likely require it of all customers too.