I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.

Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.

A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.

This is such a crazy take. Here’s a major rebuttal from mastodon.

There’s been documented cases of them using known pirated versions based on headers and stuff. As crazy as it sounds…