News for hackers. Stuff that matters.
Re:Passkeys: A Shattered Dream by mac-mc on Friday April 26, 2024 @01:34PM (#40172036)
> By requiring the passkey to be managed by a password manager, you get some anti-phishing protection. A passkey includes metadata, including the website domain that created it, and the password managers simply won't provide the passkey to the wrong domain.

There are so many apps that don't get this right. Make a login on the website, store it in 1password, and then try to login in their mobile app and it doesn't show up as a password because the associated URL is mismatched on the mobile app. Like mybank.com and auth.mybankmobileapi.com

Re:Passkeys: A Shattered Dream by mingus88 on Friday April 26, 2024 @02:53PM (#40172887)
1password has a URL field. All you have to do it add the extra URLs

Better yet, while on mobile, search for the entry of the desktop site and have it fill. 1password will ask if you want to update the entry for this site

Re:Passkeys: A Shattered Dream by nullfield on Saturday April 27, 2024 @03:46PM (#40182847)
Except they ignore subdomains. Unless you fix that on a per-item basis, in their desktop application.

I think, finally, that the reason this feels so dirty-apart from companies and lock-in and all-is that it’s taking the “something you know” as one auth factor and turning it into something that, not only do you not know, the big goal of is to make sure you can’t know but something you have.