logoalt Hacker News

MBCook • yesterday at 4:54 PM • 1 reply • view on HN

Isn’t that a bug in the Microsoft software, not the pass key specification?


Replies

autoexec • yesterday at 5:12 PM

That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank's website and some random web form with their banks logo slapped on it created on wix.com

Attacks on passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.

Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.

➕ show 1 reply