I’ve seen tech-savvy people getting phished into entering their password on a fraudulent site, despite the password manager blaring alarms that the login looked fishy.
This cannot happen with passkeys at all because crypto magic.
This cannot happen with passkeys at all because crypto magic.
My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.
But GP is saying that when the passkey is not auto-entered, the user will just use password-based login.
So the mistake will still happen even if passkeys are enabled and used, as long as password-based login remains as an option.
which they have to be, right? since passkeys are "temporary" in that they are easily lost/destroyed/temporarily unavailable, and sites are supposed to support multiple of them?
That's way too optimistic.
The core reason people enter the password in different domains is because most services suck at keeping a canonical login page. That forces users to register multiple URLs for a single credential. And from times to times, they hit a page not within their registered urls, will login and just add the new url to the pool.
Will these services magically become super competent because of passkey ? I'll respectfully doubt it.
They might not screw this specific aspect, but they'll screw enough other things that users will need to keep injecting password somewhere from times to times.