3 ms·

Most password managers check the urls before filling.

• vlovich123 4y ago
  That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".
  • danShumway 4y ago
    Similarly, passkeys don't necessarily block the phishing attack where the user goes, "ugh, this dongle/phone isn't working, I guess I need to put in one of these one-time recovery codes." Account recovery is still going to be a weak point here, and it's a kind of double-edged sword. If you're really strict about passkeys getting shared between devices or manually accessed, then users are going to lose access to accounts a lot, and recovery methods are going to get easier to accommodate those situations, which will in turn re-open phishing vulnerabilities. On the other hand, if services don't implement those recovery options, then the first time a user gets burned with losing access to an account for a week, they're going to stop using passkeys, and broader adoption will be halted.