Re:Microsoft Confirms Password Deletion for 1B Users
by afiori on Tuesday December 17, 2024 @03:09PM
(#42444797)
This ignores that most password managers check domains/origins the same way browsers do.
the only difference is maybe in-app browser where the passkey integration might work more easily but even so:
1) it is still a matter of integration and/or using an actual browser
2) in-app browsers are inherently insecure anyway (at least on android)
Re:Microsoft Confirms Password Deletion for 1B Users
by acdha on Tuesday December 17, 2024 @04:02PM
(#42445280)
> This ignores that most password managers check domains/origins the same way browsers do.
No, it doesn’t. Most password managers allow you to fill passwords for other domains and all of them allow copy-paste. The people who support those users know that phishers can convince people to do that which is why they’re encouraging adoption of WebAuthn.
This isn’t true, and that’s where your confusion comes in. Passkeys cannot be phished because the protocol includes the server name and does not expose the key to the remote server. The past decade of U2F/FIDO/WebAuth deployment has used that as the marquee selling point because it’s a very common exploit which cannot easily be prevented with traditional passwords and MFA.