4 ms·

I think your argument would also valid for 2FA approach, which is is widely encouraged regardless. Sign-up rate would drop drastically for a majority of common

I think your argument would also valid for 2FA approach, which is is widely encouraged regardless. Sign-up rate would drop drastically for a majority of common users if a good UX is not into play while developing the system workflow. But I want also say that for a great variety of solutions having 2FA or passwordless as default is valid, Slack for example has an option of demanding 2FA for all team members, which a lot of people would agree is a good thing. The "Password Security Guide" section at the article is a good example of educating people how insecure storing password, and you could do the same thing showing/enabling passwordless as a clear and easy alternative to migrate to.

jand 11y ago
You are right. Here comes the "target group" aspect (and some others) into play. Oversimplification: Are you targeting techies or eldery? Some will endure security-related hardships, others won't. As said, there is the need to watch who you design for.
cvburgess 11y ago
But most sites let you "trust this device" once you've done 2FA - passwordless doesn't have that option from what I can tell. Also, 2FA is an extra, optional layer for most users. They can choose if they want the extra hassle in exchange for security. Passwordless gives you no such option, you have to switch apps, period.