2026-10-05 17:05 UTC
Okay, update: I’ve been told that the automatic passkey upgrade is only meant to create a passkey in the same password manager the password came from, so it shouldn’t grant persistent access to the credentials to someone who didn’t have access to the password. The fact I may have gotten a passkey in a password manager that I don’t normally use looks like a bug, not how this is meant to work.
Replies (3)
-
@mcc@mastodon.social 2026-10-05 17:26
@misty@digipres.club A big problem is if you're the kind of person who uses software by building up a mental model of it, and then you catch it even once doing an "underhanded" thing like this, even if it's a *benign* or positive underhanded thing suddenly everything breaks, because your mental model is gone, anything could happen, and now you're afraid to do anything in case you hit one of the hidden "underhanded" behaviors again.
-
@wiert@mastodon.social 2026-10-05 18:25
@misty@digipres.club what passkey manager was this?
-
@tom@subdued.social 2026-10-05 20:28
@misty@digipres.club How can a web site possibly know from which password manager the user's password was entered?