3 ms·

> passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. This isn’t true, and that

by acdha 2y ago

> passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. This isn’t true, and that’s where your confusion comes in. Passkeys cannot be phished because the protocol includes the server name and does not expose the key to the remote server. The past decade of U2F/FIDO/WebAuth deployment has used that as the marquee selling point because it’s a very common exploit which cannot easily be prevented with traditional passwords and MFA.

afiori 2y ago
This ignores that most password managers check domains/origins the same way browsers do. the only difference is maybe in-app browser where the passkey integration might work more easily but even so: 1) it is still a matter of integration and/or using an actual browser 2) in-app browsers are inherently insecure anyway (at least on android)
- acdha 2y ago
  > This ignores that most password managers check domains/origins the same way browsers do. No, it doesn’t. Most password managers allow you to fill passwords for other domains and all of them allow copy-paste. The people who support those users know that phishers can convince people to do that which is why they’re encouraging adoption of WebAuthn.
- deleted 2y ago
  [deleted]