Hacker News Reader

Comment by quacktopia | Hacker News Reader

I believe passkeys can be made phishing resistant, as they can be cryptographically bound to a given application, and the application has to attest itself to your system too.

You won't be able to use your google account passkey to log into the perfect clone of "gmail.com" where the 'a' is actually a greek or cyrillic letter or something, and neither will your ageing parents. You could still paste your password into the fake site from your password manager, or the spyware on your computer could still sniff it from your clipboard.

View on HN

Password managers check the domain before they fill.

...until you login to, say, your Microsoft account on one of like 27 domains that use the same SSO and your autofill doesn't trigger so you just grumble to yourself "man I hate the modern web" and manually copy/paste it in.

Hopefully after thoroughly checking the URL but you only have two minutes before the Uber gets here and just need to get this one last thing done ASAP...

But users can and do override this decision. "Huh, why isn't 1Password autofilling my password on bank0f4merica.com? Let me quickly select 'autofill and remember'..."

I'm somewhat desensitized to this myself for non-bank use cases. It's unfortunately necessary with corporate merges and rebrands. After all, how is my password manager supposed to know that it's safe to fill my hulu.com password on disneyplus.com? The same applies to mobile apps providing some-outsourcing-vendor.com instead of my-actual-service-provider.com etc.

For passkeys, there's native support for that type of thing using "related origin requests": https://web.dev/articles/webauthn-related-origin-requests

> But users can and do override this decision.

Yes. That is a feature, not a bug.

Transferability and delegation of authority are features. Calling them "phishing vectors" only makes them seem like a bug.

Being able to enter my Hulu password on disneyplus.com is a feature, being able to enter my Bank of America password on bank0famerica.com is a bug. The problem is that the same behavior causes both.

I'll raise you a better one:

Being able to give your Hulu or Bank of America password to your spouse is a feature, but giving it to a scammer is a bug.

Can't have one without the other, but I disagree making credentials non-transferrable is the right choice.

Name one password manager with an "autofill and remember..." action that fills passwords from unrelated domains.

You're spreading nothing more than FUD. This is a completely imaginary threat vector that doesn't exist. And even threats that do exist don't always justfity security at every cost. The optimum amount of security is never 100%.

Reply on news.ycombinator.com