News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by franga2000 on Wednesday December 18, 2024 @09:13AM (#42450544)
Let's say I end up on acccounts.totallygoogle.xyz. I press "login with passkey" and my password manager says "you have no passkeys for this site". I press "login with a password" and the password manager says "you have no saved passwords for this site". What exactly is the difference?
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by arccy on Wednesday December 18, 2024 @09:26AM (#42450667)
"you" can copy out the password and still "log in" on the phishing site, leaking your password.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by vel0city on Wednesday December 18, 2024 @10:57AM (#42451554)
"Dang, this stupid password manager seems to rarely autofill right, lemme quickly paste that in there...got it!"

You can never make this mistake with a passkey or FIDO authenticator.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by rightbyte on Wednesday December 18, 2024 @04:15PM (#42455312)
You can still provide your Passkey password though to some scam. A centralized storage of your passwords.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by ianburrell on Wednesday December 18, 2024 @05:57PM (#42456440)
There is no passkey password. If there are, it is entered into the dialog box not a site. And wouldn't do any good cause the passkey is saved on the device and does a key exchange.

If you mean the password manager password, then it is entered in a different place and really hard to confuse it with a website. Also, 1Password requires extra info to login account and that is only used, usually copying from another device, when setting up device.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by vel0city on Thursday December 19, 2024 @12:12PM (#42463510)
The PIN for the hardware passkey device in my locked drawer at home is 1234567.

Oh no, you have its PIN! Can you now log in to $service as me?

Not without that hardware module.

My password for $service is hunter42.

Now you can log in as me.

See the difference?

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by rightbyte on Thursday December 19, 2024 @05:13PM (#42466264)
I am trying to come up with a counter argument but gave up. Since you are correct.

Is it fine if a waive my hands around and say "complexity"?

[ Parent | on HN ]