News for hackers. Stuff that matters.

A comment on Don't use passkeys for encrypting user data. Parent comment

Re:Don't use passkeys for encrypting user data by tredre3 on Saturday February 28, 2026 @06:27PM (#47201630)
Is this really how password managers extensions work? They inject arbitrary javascript in every page you visit?

I would have naively thought that there'd be a better and safer API for it, considering that all browsers already have the infrastructure in place to handle login autocomplete.

[ Parent | on HN ]
Re:Don't use passkeys for encrypting user data by varjolintu on Sunday March 01, 2026 @11:05PM (#47213763)
Yes. This is mandatory for all browser extensions. There's no API behind a separate permission, even if would be the best way to handle this.
[ Parent | on HN ]