Seems like the flow should be:

1. All passwords stored in password manager. 2. Login with password manager when logging in for the first time on a device. 3. Combination of OS and site/app notice that no passkey has been created for this account and offers to create one. This is presented to the user as “setting up the current device for password-less log ins.” 4. OS negotiates with site/app to install the passkey and use it for future log ins on the device.

It’s presented to the user as a convenience clearly tied to this device.

…but you still have your text password stored in the password manager’s servers…

▲

akdev1l 2 days ago | parent [-]

By still having the password the user can still be attacked via phishing

▲

thewebguyd 2 days ago | parent [-]

The user can always be attacked via phishing so long as account recovery methods exist (and they need to exist for obvious reasons). Use passkeys, but so long as you can also log in via password, or SMS code, etc., it's phishable, you can get sim swapped.

Your master password to your cloud PW manager's vault is also phishable (hence why passkeys were ideally device specific, non-exportable).

Its phishing resistant not phishing proof

▲

akdev1l 2 days ago | parent | next [-]

> hence why passkeys were ideally device specific, non-exportable

Not true. The original concept was always for them to be cloud synced.

This has nothing to do with their anti-phishing capabilities. The anti-phishing capabilities come from the fact that the password manager authenticates the application before handing out the passkey. It doesn’t matter if they are synced across devices or not.

You are correct that other login methods might be weaker than passkeys. I’m not sure how that’s related to passkeys though. In real security sensitive applications the recovery process is “go to the bank’s branch and show them your driver’s license”.

> Your master password to your cloud PW manager's vault is also phishable

No, it’s not. You would need to steal my yubikey to get access.

	▲	ivlad 2 days ago \| parent [-]
		> Not true. The original concept was always for them to be cloud synced. It was not. The original U2F spec was created before that idea was around and it talked about hardware security keys as means to store the primary key pair.

▲

crote 2 days ago | parent | prev [-]

Yeah, but it's an order-of-magnitude more complicated. It's no longer "click a link and fill in your creds on a legit-looking website", it turns into "hack someone's email, request a password reset, wait the mandatory 24 hours, do a social attack on the provider to pull off a sim swap, and fill in the 2FA code".

> Your master password to your cloud PW manager's vault is also phishable

... which is why all sensible cloud vaults have a separate enrollment key, requiring an explicit action to grant a new device access.