Most security keys ship without a PIN, and websites rarely ask

Most security keys are shipped without a PIN, and websites seldom require one to be entered. This is a notable observation given the purpose of security keys. The lack of PINs on these devices and the infrequent requests for them on websites may have implications for security. Security keys are intended to provide an additional layer of protection, but the absence of a PIN could potentially undermine this goal. The finding highlights a potential vulnerability in the way security keys are implemented and used.