So they do, in fact, do that and you have a workaround? They won't autofill on a phishing site, thus the copy/paste bypass.

It is a pretty big red-flag.

▲

MBCook an hour ago | parent | next [-]

Autofill is not the same as use.

You can not use a passkey on the wrong site. Period. They’re unphishable.

Short of somehow talking a user through finding the full private key and getting them to send that to you, there is no way to trick a user into giving you what you need to get into a website impersonating them.

That’s absolutely not true with a password manager. They may TRY to prevent you from ACCIDENTALLY entering it on a website, but they don’t stop you.

▲

john_strinlai 2 hours ago | parent | prev [-]

>They won't autofill on a phishing site,

right. and in an office setting, bob in accounting will go "weird, autofill isnt working, ill copy/paste it".

that is not a possibility with a passkey.

▲

Someone1234 2 hours ago | parent [-]

It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching.

This is where Passkeys shine, in an edge-case user that is neither of the two most common user types. Basically a unicorn situation.

	▲	john_strinlai 2 hours ago \| parent [-]
		>It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching. you must not work in regular corporate environments. this happens all the time. yes, they know how to hit the big "copy" button but don't know how to debug an extension. take a year or two to work security (or general IT support) in a non-tech-company corporate environment, and get ready to have your socks blown off. people become exceptionally literate with things they interact with all day (excel is great example of this) yet have no idea that google.example.com isn't an official google website.