<p><span class="h-card" translate="no"><a href="https://social.xenofem.me/users/nyx" class="u-url mention">@<span>nyx</span></a></span> they inject javascript into every page that overrides browser&#39;s normal webauthn flow lol</p>