[TeMPOraL]

> Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me).

It's a daily occurrence for me, because especially because of going through steps A) and B), step C) which is copy-paste is needed to actually transfer the unwieldy, unmemorizable password from the password manager that stores it, into the app that requires it, when the autofill service refuses to communicate between the two.

[tshaddox]

But that sounds like precisely what standardized passkey integration in the browser and website solves! This is honestly how I think about passkeys: they're a standard API for browsers and websites to integrate with password managers without needing a browser extension to manually look for and fill out text inputs on the page.

[rstuart4133]

> This is honestly how I think about passkeys: they're a standard API for browsers and websites to integrate with password managers without needing a browser extension to manually look for and fill out text inputs on the page.

But it isn't always that simple. I have a work laptop. It has a MDM installed, so I can't trust it. I don't run my personal password manager on it, ever. But occasionally I go to a web site I don't care too much about, whose credentials are stored in my password manager. It's not an issue; I just type that password in. That doesn't work with passkeys.

Then there is backup. If I lost my password store I'd be toast. Which means if the company that manages my passwords took a dislike to me and banned my account, I'm in a world of pain. I deliberately choose a password manager that makes that unlikely, but not everyone knows to do that. Many people use Google, Apple or Microsoft as their passkey manager. These companies have seen fit to ban accounts without warning and no recourse.

My password manager lets me export all my passwords as plain text, so for my passwords this potential for lock-in is a non issue - I just export, encrypt, upload the result to a few places, I'm safe. I can always upload the data to a another password manager. As that doesn't work for passkeys, I don't use them.

Passkeys will become acceptable to me once multiple independent storage providers become available for passkeys, and they allow me to freely choose other certified others as a backup. Until that happens, they only solved half the problem. It looks to be the half that locks their customers into their platform.

PS: this doesn't require much. Just Google/Apple to implement CXS along with government providers, and we are there. But it won't happen any time soon.