Hacker News Reader

Comment by pkulak | Hacker News Reader

Password managers check the domain before they fill.

But users can and do override this decision. "Huh, why isn't 1Password autofilling my password on bank0f4merica.com? Let me quickly select 'autofill and remember'..."

I'm somewhat desensitized to this myself for non-bank use cases. It's unfortunately necessary with corporate merges and rebrands. After all, how is my password manager supposed to know that it's safe to fill my hulu.com password on disneyplus.com? The same applies to mobile apps providing some-outsourcing-vendor.com instead of my-actual-service-provider.com etc.

For passkeys, there's native support for that type of thing using "related origin requests": https://web.dev/articles/webauthn-related-origin-requests

> But users can and do override this decision.

Yes. That is a feature, not a bug.

Transferability and delegation of authority are features. Calling them "phishing vectors" only makes them seem like a bug.

Being able to enter my Hulu password on disneyplus.com is a feature, being able to enter my Bank of America password on bank0famerica.com is a bug. The problem is that the same behavior causes both.

I'll raise you a better one:

Being able to give your Hulu or Bank of America password to your spouse is a feature, but giving it to a scammer is a bug.

Can't have one without the other, but I disagree making credentials non-transferrable is the right choice.

Name one password manager with an "autofill and remember..." action that fills passwords from unrelated domains.

You're spreading nothing more than FUD. This is a completely imaginary threat vector that doesn't exist. And even threats that do exist don't always justfity security at every cost. The optimum amount of security is never 100%.

...until you login to, say, your Microsoft account on one of like 27 domains that use the same SSO and your autofill doesn't trigger so you just grumble to yourself "man I hate the modern web" and manually copy/paste it in.

Hopefully after thoroughly checking the URL but you only have two minutes before the Uber gets here and just need to get this one last thing done ASAP...

Reply on news.ycombinator.com