You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
This is very hard for me to imagine. Even if the people running the website are incredibly incompetent, they would have to be intentionally moronic about passkey generation for what you are envisioning to be realistic.
You are right that passkeys enable brute forcing on a scale regular passwords don’t, but it doesn’t matter, because normal passkeys are just too long for this to be a worry.
But your private key should never leave your secure storage to be put anywhere. If you somehow export it and then also give someone or an LLM access to it, then this is ofc very stupid. But this attack vector is possible with every authentication.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
This is very hard for me to imagine. Even if the people running the website are incredibly incompetent, they would have to be intentionally moronic about passkey generation for what you are envisioning to be realistic. You are right that passkeys enable brute forcing on a scale regular passwords don’t, but it doesn’t matter, because normal passkeys are just too long for this to be a worry.
But your private key should never leave your secure storage to be put anywhere. If you somehow export it and then also give someone or an LLM access to it, then this is ofc very stupid. But this attack vector is possible with every authentication.