
jsonstein@masto.deoan.org ("Jeff Sonstein") wrote:
“If a user's environment mandates hardware security keys plugged directly into the login device, or uses platform-bound authenticators (like Face ID tied to the browser context), the attack chain breaks.”