3 ms·

> Passwords are phishable. Passwords auto-filled by a browser extension are not phishable.

growse 2y ago
What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible. This isn't a controversial topic, the data is pretty unambiguous. If you give humans a secret they can put in their clipboard and train them to enter it into text boxes, some fraction of them will send their credentials to the wrong people.
- saagarjha 2y ago
  Maybe we don’t actually need perfect solutions.
  - robertlagrant 2y ago
    "Maybe" is not a viable justification for a position.
    - saagarjha 2y ago
      I am being flippant. Obviously my position is that perfection is a harmful thing to strive for.
      - growse 2y ago
        We're not aiming for "perfect", we're just trying to make some progress on the phishing problem. The irony here is that many of the complaints in this thread seem to be complaining about how imperfect passkeys are. No-one disagrees that they're imperfect!
        saagarjha 2y ago
        Yes, and passkeys generally help. But your concern upthread was that any mechanism that lets users share or export passkeys (or other authentication material, such as passwords) allows a user to be phished. Basically, the very fact that this is somehow accessible means a user can be tricked into disclosing it. This is correct, but my point is that perfection in that area necessarily means that a lot of things that are useful (some of which have been shared in sibling threads) are now impossible. So we should not actually aim for perfection on phishing, but just to make improvements where possible.
- ndriscoll 2y ago
  The same thing that stops the user from going through an account recovery flow to enroll an attacker's key. Such flows are of course more necessary in a world where you can easily lose/damage the only place where your keys are stored.
jtbayly 2y ago
This. In other words, password managers have all the benefits and none of the drawbacks of passkeys. And passkeys require a password manager anyway, so why are we trying to switch?
- robertlagrant 2y ago
  They don't have the benefit of not being pastable into a phishing site.
samcat116 2y ago
Should password managers make it impossible to copy the plain text of the password? Thats the only way to make this truly not phishable
- growse 2y ago
  If you show it on a screen, someone will read it out and type it into a website. We don't need to guess at this, it happens a lot in the real world. No matter how many UX barriers you put in place, an exportable credential will be handed over to an attacker by an unwitting user at some point.
snowwrestler 2y ago
“Huh, wonder why that didn’t autofill this time.” Person copy/pastes password from manager into phishing site. Browser extensions do not prevent copy/pasting, or typing in, passwords. In contrast, there is no way to copy/paste or type in a passkey if the phishing site fails the key check. Now you might say that YOU have the discipline to never do this. And it might be true. But that’s not the same as saying autofill passwords are not phishable.

What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible. This isn't a controversial topic, the data is pretty unambiguous. If you give humans a secret they can put in their clipboard and train them to enter it into text boxes, some fraction of them will send their credentials to the wrong people.

saagarjha 2y ago
Maybe we don’t actually need perfect solutions.
- robertlagrant 2y ago
  "Maybe" is not a viable justification for a position.
  - saagarjha 2y ago
    I am being flippant. Obviously my position is that perfection is a harmful thing to strive for.
    - growse 2y ago
      We're not aiming for "perfect", we're just trying to make some progress on the phishing problem. The irony here is that many of the complaints in this thread seem to be complaining about how imperfect passkeys are. No-one disagrees that they're imperfect!
      - saagarjha 2y ago
        Yes, and passkeys generally help. But your concern upthread was that any mechanism that lets users share or export passkeys (or other authentication material, such as passwords) allows a user to be phished. Basically, the very fact that this is somehow accessible means a user can be tricked into disclosing it. This is correct, but my point is that perfection in that area necessarily means that a lot of things that are useful (some of which have been shared in sibling threads) are now impossible. So we should not actually aim for perfection on phishing, but just to make improvements where possible.
ndriscoll 2y ago
The same thing that stops the user from going through an account recovery flow to enroll an attacker's key. Such flows are of course more necessary in a world where you can easily lose/damage the only place where your keys are stored.

jtbayly 2y ago

This. In other words, password managers have all the benefits and none of the drawbacks of passkeys. And passkeys require a password manager anyway, so why are we trying to switch?

robertlagrant 2y ago
They don't have the benefit of not being pastable into a phishing site.

samcat116 2y ago

Should password managers make it impossible to copy the plain text of the password? Thats the only way to make this truly not phishable

growse 2y ago
If you show it on a screen, someone will read it out and type it into a website. We don't need to guess at this, it happens a lot in the real world. No matter how many UX barriers you put in place, an exportable credential will be handed over to an attacker by an unwitting user at some point.

snowwrestler 2y ago

“Huh, wonder why that didn’t autofill this time.” Person copy/pastes password from manager into phishing site. Browser extensions do not prevent copy/pasting, or typing in, passwords. In contrast, there is no way to copy/paste or type in a passkey if the phishing site fails the key check. Now you might say that YOU have the discipline to never do this. And it might be true. But that’s not the same as saying autofill passwords are not phishable.