Post #2937328
2026-05-19 09:39 UTC
@seanreilly@mastodon.social with a regular password manager, you can fool someone into giving credentials to another website. My *guess* is that passkey designers wanted to avoid that. This also forces website authors to stop changing the login page url every few years (which is how even a sophisticated user can get fooled with a typosquat domain or something)
Replies (1)
-
@seanreilly@mastodon.social 2026-05-19 21:09
@radex@social.hackerspace.pl are you saying that person X might trick person Y into using X's public key on a site? I wouldn't think that would be possible because presumably person Y needs to sign some kind of challenge when registering the key to prove that they have the corresponding private jet. It's likely that I've misunderstood your point though.