Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

With a password manager storing unique passwords, your password is still being sent over the network to that website each time you log in.

With a password manager storing passkeys, your private passkey is not transmitted as part of the website request. It can't be intercepted or accidentally/negligently stored in plaintext in a database or server logs.

You still have to trust the secure syncing of your passkeys, just like you do with passwords, but there are still fewer threat vectors than with passwords.



This covers a negligible percentage of all hacked accounts and is at best a tiny part of what passkeys are supposed to solve.


It’s more than you think: if I can convince you to type in your Google password at g00gl3.com I can turn around and use that password for the real server. Passkeys block that attack.


So they couldn't convince everyone to give up their privacy and use Facebook or Google to track our logins to other websites via "Login With", and this is a new way?


If by new you mean a completely different mechanism which does not share the privacy considerations of a single sign on service, yes. If you care about privacy, passkeys are a much better option.


What's the privacy issue if I use a third-party passkey manager like Bitwarden or 1Password and the passkeys are unique for each website?


same argument/logic works to justify not wearing seat belts or hell, not outlawing murder. "Won't stop/save everyone so not worth doing".


Makes sense now. I shoulda read the document, but conversation is funner.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: