Investigate passkeys for phishing-resistant authentication #9
Description
Passwords are vulnerable to credential stuffing, phishing, and keyloggers. Even with email verification, a malicious app could harvest credentials via a fake login screen.
Passkeys (WebAuthn) eliminate password transmission entirely. The OS handles authentication via biometrics/PIN, and cryptographic proof is sent instead of credentials. Native apps can use passkeys bound to our domain (login.divine.video) via platform APIs.
References:
- draft-ietf-oauth-first-party-apps §5.1 recommends passkeys
- WWDC 2022: Meet passkeys
- Android Credential Manager