@Techmeme This is exactly why passwords are good actually, and all this webauthn bullshit is just unnecessary complexity.

@SiteRelEnby @Techmeme Sorry, have to strongly disagree here. Passwords are terrible even when good passwords are used, because of the ease in phishing them with lookalike web sites. And in practice they’re even worse than that, because lots of users reuse passwords and are then vulnerable to credential stuffing attacks when one of the sites is inevitably breached. Passkeys are the best solution, but it’s fairly early and they definitely have usability and portability challenges right now.

@SiteRelEnby @Techmeme Well, at the heart of it, passkeys are really just public/private key pairs with a web protocol (webauthn) wrapped around it. If you used ssh keys on the web, you’d have a public/private key pair with … a web protocol wrapped around it. You can argue that webauthn is implemented poorly, and I’d agree to some extent, but in my opinion it or something very much like it is desperately needed.