Hacker News Reader

Comment by jms703 | Hacker News Reader

You can't enter a passkey at the wrong website.

You still need a password to exist, so while the passkey won't activate the user can still leak the account's credentials.

To cover that gap, you get rid of passwords altogether, and now users lose access if the passkey fails to sync or isn't available on one of their devices (let's say a Kindle Fire tablet)

Passkeys being bound to the domain is neat, but not without tradeoffs and practical workarounds. At least that can't be the only aspect to look at when making a choice.

My password manager won't do that either

Sometimes the url for the login page changes or I'm logging into a different part of the site and my password manager doesn't recognize it. My university used Duo for authentication but depending on which resource you were trying to access, the subdomain might be different. How would I immediately know that I had just typed in my credentials to a misspelled domain or a hacked user account on a school web server displaying a phishing login? That last one would be even more nefarious because my browser might not even display past xyz.abc.edu/ and it would even have a valid SSL cert. Even if my password manager didn't recognize that URL and I manually typed it in, my passkey manager certainly wouldn't even attempt sending a key.

The real problem is that companies/institutions should procure one domain name, and stick with it. There's no reasons so need to be redirected through 6 domain names when signing into Microsoft, all of which look like a phishing attempt URL.

One domain, one account.

It's not physically impossible to enter a password in the wrong website, though, which bites lots of people who get phished.

Reply on news.ycombinator.com