Hacker News Reader

Comment by kccqzy | Hacker News Reader

Phishing is a major problem, but it happens less than you think. Password managers are also checking the domain before supplying a saved password. A user who relies on autofilling the password every time will notice when their password manager suddenly does not autofill.

Yubikeys are a great second factor honestly. But do you want to use a Yubikey as a passkey? Sorry you are likely dissatisfied. Many websites and apps (especially apps) support passkeys but would prohibit using your Yubikey as a passkey.

View on HN

> Phishing is a major problem, but it happens less than you think.

Bullshit. Literally number one attack vector.

> Password managers are also checking the domain before supplying a saved password.

Password managers are not anywhere as ubiquitously used as you'd think. Even if you rely on password managers, you encounter scenarios where the website relies on a different domain that's not paired appropriately. Some "legitimate" mofos like Plaid used to ask password for third party website. Consumers don't see a password manager failure to fill out a password as a security issue. They see it as a routine password manager failure.

> Literally number one attack vector.

That’s an out-of-date view. The number one attack vector these days is cookie stealing. The prevalence of 2FA even weak ones like SMS-based 2FA has made plain old phishing so much less effective.

That's not correct - more than 1/3 of initial access is by phishing at present, according to Cisco Talos (and others major security publications largely agree with this). Ref: https://blog.talosintelligence.com/ir-trends-q1-2026/

What you may be confusing with is the number of incidents involving token theft, which is often facilitated by phishing.

That publication is talking about phishing as a threat to workers inside corporations and government agencies and public administrations. It’s not a thing for regular consumers. Passkeys aren’t usually used in corporate environments with an IT department anyways.

Reply on news.ycombinator.com