News for hackers. Stuff that matters.

A comment on Passkeys were invented by engineers with zero understanding of consumer brain. Parent comment

Re:Passkeys were invented by engineers with zero understandi... by inigyou on Wednesday July 22, 2026 @10:41PM (#49016217)
Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.
[ Parent | on HN ]
Re:Passkeys were invented by engineers with zero understandi... by ptman on Thursday July 23, 2026 @12:24PM (#49024221)
Desktop operating systems don't have very good separation between programs. If some malware gets access, it will be looking for e.g. ssh keys and using a keylogger to get the passphrase if you encrypted your ssh keys. Tpm protected passkeys are much better protected
[ Parent | on HN ]
Re:Passkeys were invented by engineers with zero understandi... by inigyou on Friday July 24, 2026 @02:54AM (#49032028)
That attack isn't phishing
[ Parent | on HN ]