@lapcatsoftware What’s going on over there? Is this like the third recent article that’s totally wrong?

@bynkii @rmondello As I said, it prevents phishing if you rely on auto-fill because it won’t auto-fill for a non-matching domain.

@rmondello @bynkii 1. Yes, if they know how to look up the password and don’t rely on auto-fill.

2. Can I assume that a Web site that stores cleartext passwords wouldn’t also store the private half of the passkey?

3. For sure, though I think Safari has mostly solved this.

4. It’s not really up to the user, is it? Your stated goal is to replace passwords. To the extent that’s successful, sites will see enough benefits to passkeys that they become the only option.

@bynkii @rmondello Well, I agree that the happy path is not difficult to use. When it gets to the Bluetooth/QR code stuff I don’t know. But mainly my point was that the comparison is kind of a sleight of hand. In both cases, using the built-in password manager is easy and you are safe if you only use that.

@rmondello But, of course, in the real world there are sometimes problems. The issues with passwords are well known, and I see a lot of talk about how passkeys can help. What I am not seeing is acknowledgement of what new issues passkeys bring and how they can be addressed.

@rmondello I don’t think most people have a hope of understanding passkeys, either, or that even most of the people talking about them (myself included) fully understand them. From the basic user perspective, they seem pretty similar to me: the built-in password manager generates and auto-fills them and is treated as magic that just works.