Comment by loloquwowndueo
5 days ago
I’ve seen tech-savvy people getting phished into entering their password on a fraudulent site, despite the password manager blaring alarms that the login looked fishy.
This cannot happen with passkeys at all because crypto magic.
I assume a phishing site wouldn't even attempt to use the passkey because it can't. So wouldn't it just ask for a password, and at that point, if you're gonna fall for it, you'd go and grab the actual text password anyway?
My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.
Right. It didn’t suggest it but the phishing message was convincing enough that the tech-savvy person fished the password out manually and input it anyway. A mistake for sure, and one the password manager was trying to help with, for sure, but this mistake would have been impossible with a passkey.
> this mistake would have been impossible with a passkey.
But GP is saying that when the passkey is not auto-entered, the user will just use password-based login.
So the mistake will still happen even if passkeys are enabled and used, as long as password-based login remains as an option.
1 reply →
Right. The “correct” way for a service to handle this is to disable password logins for any account that has enrolled a passkey. A few services do this, but boy howdy is it ever unfriendly to users (or at best, difficult for them to get their heads around).
> This cannot happen with passkeys at all because crypto magic.
That's way too optimistic.
The core reason people enter the password in different domains is because most services suck at keeping a canonical login page. That forces users to register multiple URLs for a single credential. And from times to times, they hit a page not within their registered urls, will login and just add the new url to the pool.
Will these services magically become super competent because of passkey ? I'll respectfully doubt it.
They might not screw this specific aspect, but they'll screw enough other things that users will need to keep injecting password somewhere from times to times.