Hacker News Reader

Comment by eadmund | Hacker News Reader

> Passwords are phishable.

Passwords auto-filled by a browser extension are not phishable.

“Huh, wonder why that didn’t autofill this time.” Person copy/pastes password from manager into phishing site.

Browser extensions do not prevent copy/pasting, or typing in, passwords. In contrast, there is no way to copy/paste or type in a passkey if the phishing site fails the key check.

Now you might say that YOU have the discipline to never do this. And it might be true. But that’s not the same as saying autofill passwords are not phishable.

What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible.

This isn't a controversial topic, the data is pretty unambiguous. If you give humans a secret they can put in their clipboard and train them to enter it into text boxes, some fraction of them will send their credentials to the wrong people.

Maybe we don’t actually need perfect solutions.

"Maybe" is not a viable justification for a position.

I am being flippant. Obviously my position is that perfection is a harmful thing to strive for.

We're not aiming for "perfect", we're just trying to make some progress on the phishing problem.

The irony here is that many of the complaints in this thread seem to be complaining about how imperfect passkeys are. No-one disagrees that they're imperfect!

Yes, and passkeys generally help. But your concern upthread was that any mechanism that lets users share or export passkeys (or other authentication material, such as passwords) allows a user to be phished. Basically, the very fact that this is somehow accessible means a user can be tricked into disclosing it. This is correct, but my point is that perfection in that area necessarily means that a lot of things that are useful (some of which have been shared in sibling threads) are now impossible. So we should not actually aim for perfection on phishing, but just to make improvements where possible.

The same thing that stops the user from going through an account recovery flow to enroll an attacker's key. Such flows are of course more necessary in a world where you can easily lose/damage the only place where your keys are stored.

This. In other words, password managers have all the benefits and none of the drawbacks of passkeys. And passkeys require a password manager anyway, so why are we trying to switch?

They don't have the benefit of not being pastable into a phishing site.

Should password managers make it impossible to copy the plain text of the password? Thats the only way to make this truly not phishable

If you show it on a screen, someone will read it out and type it into a website. We don't need to guess at this, it happens a lot in the real world.

No matter how many UX barriers you put in place, an exportable credential will be handed over to an attacker by an unwitting user at some point.

Reply on news.ycombinator.com