News for hackers. Stuff that matters.
Re:We replaced passwords with something worse by palata on Thursday August 07, 2025 @01:31PM (#44827550)
Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys?

Counter-example: I can write a password manager that will not allow you to export/import passwords.

Re:We replaced passwords with something worse by valenterry on Thursday August 07, 2025 @08:51PM (#44832187)
No, that's not what I meant.

There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up.

For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?

Re:We replaced passwords with something worse by palata on Friday August 08, 2025 @06:58AM (#44835590)
I don't think your reasoning holds. You say "I know situations where one passkey client works with some websites and not others, but I don't know situations where a website works with some clients and not others".

If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?

Re:We replaced passwords with something worse by valenterry on Friday August 08, 2025 @09:22AM (#44836648)
> but I don't know situations where a website works with some clients and not others

For example: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselec...

> If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?

Unfortunately not...

Re:We replaced passwords with something worse by palata on Saturday August 09, 2025 @05:51AM (#44845262)
> For example: [...]

Those sound like requirements similar to those that can be enforced with passwords. My company enforces an SSO system with an MFA scheme that is controlled by the IT department. I can use my password manager for the password part, but I must use the mandatory MFA app.

In that sense, I am not sure it is so different from passkeys?

Re:We replaced passwords with something worse by valenterry on Saturday August 09, 2025 @11:27PM (#44852545)
Now you are not comparing passwords with passkeys anymore, but MFA with passkeys. Not sure what the point is in the context of the discussion.

> In that sense, I am not sure it is so different from passkeys?

Yes, if it means "company specific SSO* and a company chooses to force you to use the hardware they decided on, then that is in fact not very different from the passkey constraints.