A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or three) different things, depending on how it’s stored.
[This comment has been deleted by an automated system]
This is where PAKE algorithms for secure password checks fits in
https://slrpnk.net/comment/3782237
The second factor doesn’t necessarily exist, since you’ve moved all of that to the client side now. It entirely depends on implementation and that the implementation is done correctly and is honest. The server only knows that you have the key, it’s single factor authentication.
In the past, it verifies that I know the password and that I have a key on the server side through separate challenges.
It’s still way better than username / password, it just has new (more difficult) vulnerabilities.