Yes but if you have a password manager that's set up well you'll never be copy pasting passwords in the first place. If the password doesn't show up you know there's a problem.
The benefit of a passkey here isn't zero but it's at the minimum.
The benefit of a passkey here isn't zero but it's at the minimum.
Meanwhile there are other security benefits as well. With a password, that static credential is transmitted in the handshake. It can be mishandled somewhere in between, and now that entire root credential is potentially compromised. This is just impossible with a passkey. The credential never leaves the client. In some implementations, the credential never leaves a secure enclave, never even entering the client's system memory. You can't say the same for passwords, not even close.
> password doesn't show up you know there's a problem
Here is your contradiction.
The normal person will just assume that some tech isn't working today again.
A key point of passkeys seems to be that it guarantees to the site owner that the user cannot be phished, without having to make assumptions on whether the user is tech-stupid.
If someone only ever saved passwords from the browser UI they really could have no idea how to manually copy a password, while getting along fine.
Well gee how nice for the site owner.
Problem is my priorities are my absolute ability to never lose my most critical assets through some means outside my control, not the site's convenience.
It was ok to use imperfect systems back in the days when the bank and the store and even the government all had a desk a mile away you could go to in person and get anything cleared up and override all possible "usually it works like this" with your physical presense an drivers licence and birth certificate or simply 5 people who all attest they know you.
We no longer have that ultimate backup plan, so really F anyone's attempt to justify basically tricking people into doing something unwise that puts them at actually greater risk because their life is less under their own control, and doing this under the very banner of claiming to care about the users safety!
It's freaking amazing.