Post by @tay@tech.lgbt

2026-09-08 16:30 UTC

@rmondello@hachyderm.io For example, recently, the US Administration sanctioned the organisation Autistici/Inventati, for "support[ing] the operations of far-left terrorist networks" - I am not going to discuss the validity of that - but, as a result, their primary domain was seized, and due to the implementation of Passkeys taking away that agency from users, served conveniently to enforce the USGov's decision, as, anyone who set up FIDO based authentication found themselves needing to recover their account And of course, yes, requiring account recovery would have been worth it just for the sake of, if it was a phishing site the user went to, would only be given a new (hopefully nowhere-else-used) password. And yes, it would be unreasonable to expect your password manager to magically know that this domain is actually the same as another - but with standard passwords,a user was given the freedom to bypass the 'This is the wrong site' warning and hit 'Fill anyway', or just manually copy and paste their password.

Replies (1)

@tay@tech.lgbt 2026-09-08 16:33

@rmondello@hachyderm.io For another example, it used to be common for a website or app to ask for your password for a different site. Of course, I am not going to frame this if it was a good idea, but even now - if an OAuth API is not provided or not sufficient for what a user wants to achieve, acting as the user with their credentials, is literally the only option to make the computer act in the user's favour, but because this is also the way genuinely malicious actors interact with a service, it's easy to lump together all this kind of adversarial behaviour into 'malicious' or 'fraudulent'. And of course, Netflix aren't too happy about user's sharing their password, but I don't think it should be the job of my password manager to protect Netflix' business model. And, another thing given the whole Recent Current Event Cycle: I can't backup my 1P vault with Passkeys, so if 1P (or the friend who's family plan I leech off, or the company they work for who provide said plan) suddenly close my account - I'm SOL.

Open ##5098919