SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-webauthn-rp-scope

Why can a WebAuthn passkey resist a lookalike site's login prompt?

The credential is scoped to its relying party, usually the real site's domain.

Start playing free

  1. It recognizes the site's logo
  2. It checks the user's typing
  3. It works only for its RP ID ✔

Why: WebAuthn binds a credential to a relying party identifier. A different domain cannot ask the authenticator to use that credential, removing the reusable secret a fake site tries to steal.

Huh, didn't know that: The authenticator keeps the credential private key from being exposed to the website.

The dad joke
The passkey saw the wrong domain and said, 'I do not work here.'
Like this card?
Play the game

References

Answer: It works only for its RP ID. WebAuthn binds a credential to a relying party identifier. A different domain cannot ask the authenticator to use that credential, removing the reusable secret a fake site tries to steal.

  1. W3C Web Authentication Level 3 www.w3.org/TR/webauthn-3
    A public key credential can only be used for authentication with the same entity
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhat does current NIST guidance say about password composition rules?

That's stuff everyone should know.