Passkeys - can you turn off the master password verification for sites?

Well, understood. However, I’ve already unlocked anyway (to gain access to the vault). Also, you can fill passwords all day long without having to reenter you master password (as long as you don’t let the browser extension lock) so why should passkeys be any different? I can see for some, highly-sensitive or risky accounts, have it set to require a master password reentry but not on everything.

And, @ Nail1684, I did read through that thread you linked to. I understand that this isn’t a BW thing, that it’s driven by the passkey alliance (or whatever it’s called). I tend to agree with some of the sentiments in that other thread that this will discourage passkey adoption. I’ll probably still keep migrating to passkeys as sites allow for them, mainly to alleviate the risk from phishing, but this usability thing really stings. Hopefully the feedback on this is getting communicated loudly to the passkey rulemakers. I mean, for sure make a 2nd verification the default but allow users to turn it off if they’ve already authenticated, which is what happens automatically when using a password manager.

1 Like