| ▲ | lapcat 4 hours ago |
| > Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`. Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly? |
|
| ▲ | Latty 4 hours ago | parent | next [-] |
| You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which makes it much harder to bypass. |
| |
| ▲ | lapcat 4 hours ago | parent [-] | | > The browser handles the passkey matching to the domain which is obviously a better place to do it. I'm not sure why you're making a distinction. In many cases the browser is the password manager. | | |
| ▲ | Latty 4 hours ago | parent [-] | | Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and standard, so e.g: sites aren't going to break it by changing the log-in subdomain routinely, as has been common historically. Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well. My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees. | | |
| ▲ | cruffle_duffle 3 hours ago | parent [-] | | “There have been sites that blocked the autofilling of passwords and so on as well.” Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice? That and blocking paste in fields like bank account numbers and stuff. Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it? | | |
| ▲ | pnw an hour ago | parent [-] | | Blocking bank account numbers from being pasted is considered an error prevention measure. By forcing people to enter it manually at least once, you stop them from blindly pasting the wrong number twice. There's no real regulation requiring blocking paste but it has become an annoying informal standard of sorts. |
|
|
|
|
|
| ▲ | jkubicek 4 hours ago | parent | prev | next [-] |
| The users are the ones manually copy/pasting the password. There's no way the password manager could prevent this short of disallowing copying/viewing passwords. |
|
| ▲ | conradludgate 2 hours ago | parent | prev | next [-] |
| The password integration breaks because it's trying to detect password fields rather and failing because of weird HTML/JS code. The passkey integration goes the other way, which is much more reliable. |
|
| ▲ | 6P58r3MXJSLi 4 hours ago | parent | prev [-] |
| > Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly? Gell-Mann amnesia effect https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_... |
