4 ms·
What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible. This isn't a controversial topic,
by growse 2y ago
What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible.
This isn't a controversial topic, the data is pretty unambiguous. If you give humans a secret they can put in their clipboard and train them to enter it into text boxes, some fraction of them will send their credentials to the wrong people.
- saagarjha 2y agoMaybe we don’t actually need perfect solutions.
- robertlagrant 2y ago"Maybe" is not a viable justification for a position.
- saagarjha 2y agoI am being flippant. Obviously my position is that perfection is a harmful thing to strive for.
- growse 2y agoWe're not aiming for "perfect", we're just trying to make some progress on the phishing problem. The irony here is that many of the complaints in this thread seem to be complaining about how imperfect passkeys are. No-one disagrees that they're imperfect!
- saagarjha 2y agoYes, and passkeys generally help. But your concern upthread was that any mechanism that lets users share or export passkeys (or other authentication material, such as passwords) allows a user to be phished. Basically, the very fact that this is somehow accessible means a user can be tricked into disclosing it. This is correct, but my point is that perfection in that area necessarily means that a lot of things that are useful (some of which have been shared in sibling threads) are now impossible. So we should not actually aim for perfection on phishing, but just to make improvements where possible.
- ndriscoll 2y agoThe same thing that stops the user from going through an account recovery flow to enroll an attacker's key. Such flows are of course more necessary in a world where you can easily lose/damage the only place where your keys are stored.