News for hackers. Stuff that matters.

A comment on Concerns about Passkeys. Parent comment

Re:Concerns about Passkeys by comex on Friday July 19, 2024 @05:13PM (#41011325)
In the hypothetical scenario where websites block Keepass, Keepass would not be sending “bad data” to the website. Its interaction with the website would not be noncompliant in any way. Rather, the website would be punishing Keepass for a separate interaction between Keepass and the user.

A more apt analogy would be if the http server sent an 400 to all requests from browsers known to support ad blocking.

[ Parent | on HN ]
Re:Concerns about Passkeys by paradox460 on Friday July 19, 2024 @08:05PM (#41012791)
Not so hypothetical. PayPal supports passkeys, but does browser sniffing to only enable it in Safari on Mac. I could tell my browser to fake it's UA to use 1password's passkeys, but to what end?
[ Parent | on HN ]
Re:Concerns about Passkeys by warkdarrior on Friday July 19, 2024 @06:20PM (#41012008)
It is potentially bad data, since authentication data is supposed to show that a valid user wants to log in to the service. If the client makes it easy for anyone to pretend to be that user, than the authentication data is bad data.
[ Parent | on HN ]