Passkeys
A one-time code is phishable: a live relay uses it inside its 30 s window. A passkey signs only for the domain that registered it, so 0 relayed sign-ins succeed. It also removes the phone number from the attack.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Text message code | Passkey |
|---|---|---|---|
| Throughput (Relayed) | none | 0 req/s Fail | 0 req/s Pass |
| Throughput (Swapped) | none | 0 req/s Fail | 0 req/s Pass |
| Availability (Admins) | at least 99% | 99.896% Pass | 100% Pass |
| p99 latency (Admins) | under 1 s | 656 ms Pass | 71 ms Pass |
| Monthly cost | 10 USD/mo | 8 USD/mo | |
| Error rate | 0.1% | 0% |
Key numbers
| Number | Value |
|---|---|
| Auth check, median | 0.1 ms |
| Checks per second, one auth part | 10,000 ops/s |
| SMS provider call, median | 150 ms |
Limit 1/s per account · all codes tried in 12 days
How it works
A second sign-in step should stop an attacker who knows the password. A code sent by text message or made by an app does that against a simple thief. It does not stop a live relay. The attacker builds a look-alike of the admin console. The admin types the password and the code into the fake page. The fake page passes both to the real console at once. The code is still valid for its 30 s window, so the attacker is in.
A second weakness is the phone number. An attacker can take over the number with a SIM swap, and then receives the codes.
A passkey works in a different way. The device holds a private key, and the server holds the public key. At sign-in, the device signs a challenge. It signs only for the domain that registered the key. A look-alike site has another domain, so the device does not sign, or the signature is useless on the real site. There is no code to relay, and no phone number to take.
In the mini board attackers run a look-alike admin console and swap phone numbers, and the limit is 0 attacker sign-ins for 40 admins. The text code lets some in. Passkeys let none in, and admin p99 stays under 1 s.
Plan the recovery path for a lost device, because it is now the weak point.
In the levels you choose the second step and check the number of attacker sign-ins.