Hacker News Reader

Comment by growse | Hacker News Reader

What stops the user pasting their password out of their password manager into a random evil site? Auto-fill isn't infallible.

This isn't a controversial topic, the data is pretty unambiguous. If you give humans a secret they can put in their clipboard and train them to enter it into text boxes, some fraction of them will send their credentials to the wrong people.

View on HN

The same thing that stops the user from going through an account recovery flow to enroll an attacker's key. Such flows are of course more necessary in a world where you can easily lose/damage the only place where your keys are stored.

Maybe we don’t actually need perfect solutions.

"Maybe" is not a viable justification for a position.

I am being flippant. Obviously my position is that perfection is a harmful thing to strive for.

We're not aiming for "perfect", we're just trying to make some progress on the phishing problem.

The irony here is that many of the complaints in this thread seem to be complaining about how imperfect passkeys are. No-one disagrees that they're imperfect!

Yes, and passkeys generally help. But your concern upthread was that any mechanism that lets users share or export passkeys (or other authentication material, such as passwords) allows a user to be phished. Basically, the very fact that this is somehow accessible means a user can be tricked into disclosing it. This is correct, but my point is that perfection in that area necessarily means that a lot of things that are useful (some of which have been shared in sibling threads) are now impossible. So we should not actually aim for perfection on phishing, but just to make improvements where possible.

Reply on news.ycombinator.com