Hacker News Reader

It's worth keeping in mind that if you enter your password in an attacker-controlled website, you lose your entire credential, not just one malicious authentication/signature using it such as here.

Also, this vulnerability is very patchable; password phishing is incredibly hard to prevent.

And, in fact, has already been patched in all major browsers.

Although this is an attack that can be carried out in practice, it is not quite as scalable as phishing passwords of potentially millions of users across the world. Passkeys are still in general more phish-proof than passwords.

I wouldn't dance on the grave yet.