Comment by overfeed
5 days ago
> But they're wrong. You are not too smart to be tricked. Nobody is.
If my password manager is entering my password for me, so how can I be tricked? That's the superpower for passkeys, right? It also applies for plain passwords. Infact, if a login page looks familiar, but my password manager doesn't show any matching credentials, that throws up red flags for me, because I only use my password manager.
Because password managers allow you to use a password and 2fa even if the url doesn't match. And sites often legitimately change domain or have multiple domains which trains users that sometimes it doesn't work and you have to override the automatic matching.
Passkeys physically don't allow you to send them to the wrong sites so the sites have to make sure they keep working.
So password managers work right up until you stop using the password manager. This also applies to passkeys magic protection against phishing. Because of limitations with passkeys, there is always an alternative login mechanism or recovery process and that is just as easy to phish. Maybe easier given the complexity of passkeys and befuddled users.
"Weird, my password manager isn't submitting my password properly. Well, that happens sometimes. I'll just copy and paste it" [or manually select a password to autofill]
Huh, my passkey isn't working. Guess I have to go do the account recovery dance or login old school to fix it.
If the password database of the website is hacked the attacker knows your password for that very website. With passkeys he knows your public key.
Let's assume I generated the password and that the site is at least using md5 for password storage. Now the attacker does not get my password by breaching.