That's not what two-factor means. Forget about passkeys -- if you use a password manager, and that password manager has a biometric lock, your accounts don't thereby have a biometric lock as a second factor. The transitive property doesn't apply here.
replyI’d say it does apply transitively, but only if the weakest link itself is also strong enough, and passwords are not.
replyAnd even a passkey on a phone that doesn't require authentication is immune to remote phishing and cloning.
reply