Why can a passkey not be used on a phishing look-alike domain?

Question

Accepted Answer

The authenticator checks the request origin against the stored relying-party ID and refuses a mismatch — The authenticator only signs when the requesting origin matches the passkey's stored RP ID, so a look-alike domain gets no valid assertion. It is not a heuristic domain warning, not tied to the TLS certificate as a key, and the private key is never transmitted at all.

Answer

The browser warns the user that the domain is unfamiliar and cancels the sign-in automatically

Answer

The passkey is encrypted with the real domain's TLS certificate, which the fake site lacks

Answer

The private key is emailed to the registered address, so a look-alike site never receives it

Why can a passkey not be used on a phishing look-alike domain?

Why this is the answer

More Web Security flashcards