Comment by solyin

5 days ago

The specific security benefit is that there's no way for a tech-stupid person, or a tech-literate person who's short on sleep, to copy paste their password into p4ypal.com instead of PayPal.com.

12 comments

solyin

Reply
Dylan16807  5 days ago

Yes but if you have a password manager that's set up well you'll never be copy pasting passwords in the first place. If the password doesn't show up you know there's a problem.

The benefit of a passkey here isn't zero but it's at the minimum.

  • vel0city  5 days ago

    I've used a number of password managers over decades. I'm still having to copy and paste passwords from time to time due to poor/hostile website designs, needing to authenticate into a browser/app that doesn't have the plugin configured yet, bugginess on the plugin detecting the right site, etc. And in the end, if the user can copy and paste that wherever, the user will copy and paste that wherever.

    Meanwhile there are other security benefits as well. With a password, that static credential is transmitted in the handshake. It can be mishandled somewhere in between, and now that entire root credential is potentially compromised. This is just impossible with a passkey. The credential never leaves the client. In some implementations, the credential never leaves a secure enclave, never even entering the client's system memory. You can't say the same for passwords, not even close.

    • fiddlerwoaroof  5 days ago

      Yeah, a lot of websites these days seem to block or mess up autofill where I actually want it: I can’t say how many websites break credit card autocomplete, TOTP code autocomplete (e.g. via Apple’s native TOTP implementation), username/password autocomplete. I can never really tell if it’s incompetence or a misguided idea of security, but it’s extremely annoying.

  • thayne  5 days ago

    This would be true if websites consistently annotated inputs correctly, but they don't. So password managers are left to guess what input is the username, which is the password, etc. and they don't always get it right.

  • nh2  5 days ago

    > for a tech-stupid person

    > password doesn't show up you know there's a problem

    Here is your contradiction.

    The normal person will just assume that some tech isn't working today again.

    A key point of passkeys seems to be that it guarantees to the site owner that the user cannot be phished, without having to make assumptions on whether the user is tech-stupid.

    • Brian_K_White  5 days ago

      "it guarantees to the site owner that the user cannot be phished"

      Well gee how nice for the site owner.

      Problem is my priorities are my absolute ability to never lose my most critical assets through some means outside my control, not the site's convenience.

      It was ok to use imperfect systems back in the days when the bank and the store and even the government all had a desk a mile away you could go to in person and get anything cleared up and override all possible "usually it works like this" with your physical presense an drivers licence and birth certificate or simply 5 people who all attest they know you.

      We no longer have that ultimate backup plan, so really F anyone's attempt to justify basically tricking people into doing something unwise that puts them at actually greater risk because their life is less under their own control, and doing this under the very banner of claiming to care about the users safety!

      It's freaking amazing.

      1 reply →