> There is nothing to prevent you from entering your super secure u quiet password on the wrong site if you get phished.

You replied to someone talking about password managers, which objectively do exactly that.

> Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.

And Passkeys don't offer portability, user choice, or user control.

Cryptography may be a solution, passkeys are one technical implementation that at is core is designed around smartphone-first, vendor-first, brand-loyality-first thinking.

▲

john_strinlai 2 hours ago | parent [-]

>which objectively do exactly that

password managers do not do that. open up your password manager, press "copy" on the password, and then paste it into a random website. it will paste it.

(i think 1password just recently enabled an option that will warn you if the website is different than the one it has, but it still lets you paste it)

▲

Someone1234 2 hours ago | parent [-]

So they do, in fact, do that and you have a workaround? They won't autofill on a phishing site, thus the copy/paste bypass.

It is a pretty big red-flag.

▲

MBCook an hour ago | parent | next [-]

Autofill is not the same as use.

You can not use a passkey on the wrong site. Period. They’re unphishable.

Short of somehow talking a user through finding the full private key and getting them to send that to you, there is no way to trick a user into giving you what you need to get into a website impersonating them.

That’s absolutely not true with a password manager. They may TRY to prevent you from ACCIDENTALLY entering it on a website, but they don’t stop you.

▲

john_strinlai 2 hours ago | parent | prev [-]

>They won't autofill on a phishing site,

right. and in an office setting, bob in accounting will go "weird, autofill isnt working, ill copy/paste it".

that is not a possibility with a passkey.

▲

Someone1234 2 hours ago | parent [-]

It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching.

This is where Passkeys shine, in an edge-case user that is neither of the two most common user types. Basically a unicorn situation.

	▲	john_strinlai 2 hours ago \| parent [-]
		>It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching. you must not work in regular corporate environments. this happens all the time. yes, they know how to hit the big "copy" button but don't know how to debug an extension. take a year or two to work security (or general IT support) in a non-tech-company corporate environment, and get ready to have your socks blown off. people become exceptionally literate with things they interact with all day (excel is great example of this) yet have no idea that google.example.com isn't an official google website.