I’ve seen tech-savvy people getting phished into entering their password on a fraudulent site, despite the password manager blaring alarms that the login looked fishy.

This cannot happen with passkeys at all because crypto magic.

▲

hbn 2 hours ago | parent [-]

I assume a phishing site wouldn't even attempt to use the passkey because it can't. So wouldn't it just ask for a password, and at that point, if you're gonna fall for it, you'd go and grab the actual text password anyway?

My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.

▲

MrDOS 2 hours ago | parent | next [-]

Right. The “correct” way for a service to handle this is to disable password logins for any account that has enrolled a passkey. A few services do this, but boy howdy is it ever unfriendly to users (or at best, difficult for them to get their heads around).

▲

loloquwowndueo 2 hours ago | parent | prev [-]

Right. It didn’t suggest it but the phishing message was convincing enough that the tech-savvy person fished the password out manually and input it anyway. A mistake for sure, and one the password manager was trying to help with, for sure, but this mistake would have been impossible with a passkey.

	▲	joshuaissac 13 minutes ago \| parent [-]
		> this mistake would have been impossible with a passkey. But GP is saying that when the passkey is not auto-entered, the user will just use password-based login. So the mistake will still happen even if passkeys are enabled and used, as long as password-based login remains as an option.