Don't use passkeys for encrypting user data

Re:Don't use passkeys for encrypting user data by lxgr on Saturday February 28, 2026 @03:01PM (#47199572)

Does their Firefox extension not inject its own WebAuthN implementation into every visited site on Linux? It does for me on macOS (i.e. it overrides the OS/browser-provided one).

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by tredre3 on Saturday February 28, 2026 @06:27PM (#47201630)

Is this really how password managers extensions work? They inject arbitrary javascript in every page you visit?

I would have naively thought that there'd be a better and safer API for it, considering that all browsers already have the infrastructure in place to handle login autocomplete.

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by varjolintu on Sunday March 01, 2026 @11:05PM (#47213763)

Yes. This is mandatory for all browser extensions. There's no API behind a separate permission, even if would be the best way to handle this.

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by bpye on Saturday February 28, 2026 @08:00PM (#47202435)

As someone that uses a YubiKey for WebAuthN - I really wish Bitwarden didn't do this. I know I can turn it off, but it's a bad default.

[ Parent | on HN ]