Comment by lxgr
8 days ago
But users can and do override this decision. "Huh, why isn't 1Password autofilling my password on bank0f4merica.com? Let me quickly select 'autofill and remember'..."
I'm somewhat desensitized to this myself for non-bank use cases. It's unfortunately necessary with corporate merges and rebrands. After all, how is my password manager supposed to know that it's safe to fill my hulu.com password on disneyplus.com? The same applies to mobile apps providing some-outsourcing-vendor.com instead of my-actual-service-provider.com etc.
For passkeys, there's native support for that type of thing using "related origin requests": https://web.dev/articles/webauthn-related-origin-requests
> But users can and do override this decision.
Yes. That is a feature, not a bug.
Transferability and delegation of authority are features. Calling them "phishing vectors" only makes them seem like a bug.
Being able to enter my Hulu password on disneyplus.com is a feature, being able to enter my Bank of America password on bank0famerica.com is a bug. The problem is that the same behavior causes both.
I'll raise you a better one:
Being able to give your Hulu or Bank of America password to your spouse is a feature, but giving it to a scammer is a bug.
Can't have one without the other, but I disagree making credentials non-transferrable is the right choice.
Name one password manager with an "autofill and remember..." action that fills passwords from unrelated domains.
You're spreading nothing more than FUD. This is a completely imaginary threat vector that doesn't exist. And even threats that do exist don't always justfity security at every cost. The optimum amount of security is never 100%.