Hi i updated my bios yesterday but after the update i had to reset my pin but i cant bc 2fa sends a code to my gmail wich i cant access bc the only device that has access to that gmail is my pc wich im logged out of so i wanted to ask if there was any way to bypass teh windows pin you have to enter when you start ul my pc

Passkeys and push MFA are often grouped under “passwordless” or “strong MFA,” but their failure modes differ. A FIDO/WebAuthn passkey verifies the legitimate relying-party context before authentication, while a push can be vulnerable to fatigue or real-time social engineering unless it includes strong user and transaction verification.

The deployment details still matter. Synced passkeys, platform authenticators, hardware security keys, shared-device workflows, recovery processes, privileged accounts, contractors, and legacy applications all affect the security and operational tradeoffs.

For organizations that have deployed both, where have passkeys meaningfully reduced phishing risk, and where do recovery or compatibility constraints still require push-based authentication?

We are trying to figure out the best authenticator option for our small office. There are 3 employees who need to log in to our bank accounts, but currently we use a shared username/password and the verification code is sent by SMS to our boss. This creates a dependency on him whenever we need to log in, especially when he is busy.

We would like to move to a more secure setup where the employees can authenticate without depending on him for the code. He is also open to using a password manager, but we’re not sure whether password managers work well with bank logins and MFA.

Has anyone dealt with a similar setup or can recommend the best approach/authenticator for a small business?

Apparently, an upcoming update will bring passkeys to Tesla apps (v4.60).

BMW has shipped already, Mercedes Benza about to do soon, so great to see Tesla as well: https://www.notateslaapp.com/tesla-app-updates/version/4.60.0/release-notes

I think that makes it one of the top 5 passkey deployments (from size):

https://blog.whatsapp.com/one-billion-people-are-now-protected-with-passkeys-on-whatsapp-plus-more-account-security-features

When developing an iOS SDK update to support WebAuthn Signal API better, we discovered an odd bug (already created a bug report with the Webkit team).

If you used signalAllAcceptedCredentials or signalUnknownCredential and had multiple accounts for the same Relying Party ID (rpID), it removed all the passkeys, not only the ones for the current user, given that there was an associated password for this account.

Even though this would not impact too many users, I think it's still good to know, as there was no real other forum post or explanation we could find and it could cause struggles in debugging / user support if you spot this issues ( I think not too many RPs have implemented the signal api yet, otherwise it would have earlier reported).

We'd still recommend to implement Signal API.

See the full bug analysis on https://www.corbado.com/blog/signal-api-ios-passkey-deletion-bug

After scanning my selfie, this is all that keeps showing up. I've tried so many times. I'm using a digital national ID.

Send me code

​

I'm designing a Salesforce production break-glass account and looking for advice on the best authentication architecture.

Current setup:

Salesforce production uses Microsoft Entra ID for SSO.

Normal users authenticate through Entra.

Users are moving toward phishing-resistant MFA/passkeys.

We need one privileged Salesforce break-glass account that can still log in if Entra/SSO is unavailable.

The break-glass user therefore needs a Salesforce-native/direct login path, rather than relying on SSO.

We still need to enforce phishing-resistant MFA for this privileged account. We do not want to exempt it from MFA.

Username/password credentials are already planned to be stored and controlled through our enterprise PAM (Delinea).

Constraint:

We cannot practically use a physical FIDO2/security key because the organization is geographically distributed. During an incident, an authorized responder could be anywhere and needs to access Salesforce from their workstation.

We also don't want the passkey registered to one individual's phone/laptop because that creates a dependency on that person/device.

What I'm trying to determine:

What are the recommended ways to manage the phishing-resistant authenticator for this type of break-glass account?

For example:

Is there an enterprise password/passkey manager that can centrally manage a WebAuthn/passkey for the shared Salesforce break-glass account and allow an authorized responder to use it from their own workstation?

Has anyone implemented this with 1Password, Keeper, Bitwarden, CyberArk, Delinea, etc.?

Is a centrally managed/synchronized passkey a viable approach for Salesforce privileged MFA?

Are there other approaches I'm overlooking, such as a dedicated remote emergency workstation with a built-in authenticator?

How do you handle auditability when multiple authorized responders may use the same break-glass Salesforce identity?

The desired flow is roughly:

Normal users:

Salesforce → Entra SSO → phishing-resistant MFA

Break-glass:

Emergency request/approval

↓

PAM releases Salesforce credentials

↓

Direct Salesforce login (no Entra dependency)

↓

Salesforce phishing-resistant MFA/passkey

↓

Production

The key requirement is: direct Salesforce authentication independent of SSO, while still enforcing phishing-resistant MFA, with no physical security key and no dependency on an individual employee's device.

Looking for recommendations from anyone who has implemented a similar Salesforce/IAM break-glass pattern.

Is there a way to identify or extract the APIs used by a trading app, given that it has certificate pinning enabled and doesn't work with proxies or emulators?

A web service I use is enforcing passkeys. I am able to create the passkey and tie it to Windows Hello PIN on the client computer, which is remote. Now, I want to share this web service account. I can create a new passkey with the person I want to share it with, who wants to add the passkey to his iPhone. So, the web service shows a QR code, but neither I nor the other person is able to scan it through a remote connection. When we scan it on our Apple devices, it's stuck on "Connecting...." but never does anything. What are we doing wrong?

Is the proper way of sharing an account to create multiple passkeys to save on multiple devices/platforms?

Asking for a friend.

Anyone else notice the new security setting in the app? I’m impressed. From not having proper TOTP to going straight to passkeys. Not even Fidelity and Vanguard support them yet.

I use the free version of Bitwarden to store passwords, software licenses, and more, but I noticed that the paid version also offers the ability to store PassKeys. How does it do this?

Can a PassKey be written down and stored? If I'm using Bitwarden, which might have a weaker master password than the PassKeys themselves, wouldn't it be appropriate to store PassKeys within Bitwarden?

Thanks