I'm already highly sceptical because of the authors previous "solutions" for "a password replacement": just rely on one time password links via email. When the

I'm already highly sceptical because of the authors previous "solutions" for "a password replacement": just rely on one time password links via email. When the subject of mailbox security is mentioned he responds with "I'm not trying to solve that part of the problem". Right. So of course, we get the ridiculous statements like: - complaining that TOTP provides a system for fallback codes. The author didn't write them down, and of course they're stupid and pointless and let's quickly forget about them because his "solution" has literally no fallbacks. - responses in this thread where the author says "well what if a bank just steals your money?", when someone mentions that even credit cards are easier to revoke: you can call the bank to cancel the card. - responses to questions about it's open source status (because no License was specified) that seem more like a fucking lunch order at Subway: "which one is your favourite?". This leads on to one of my favourite bits in this thread: - This absolute gem (emphasis mine), from the author who claims it's "production ready for four billion people": > I don't want to have any rights or responsibility, just Do Whatever You Want license. The author loves to dismiss current solutions with weird anecdotal evidence. He freely admits he doesn't use TOTP on many sites, even when it's available. He never "signs out" of applications. He claims that users "don't care" if their account on a site is breached. For reference, the "current solution" that I believe still beats this system is: Password managers, with a secure "master" (i.e. keychain on iOS is unlocked by TouchID/ system pin) combined with TOTP are achievable, don't rely on a fucking electron app, and provide fallbacks if a 3nd factor authentication device is lost. But ultimately all of that is just gravy when you look at the most basic of irony in this whole thing: The author's stated goal is to remove the need for passwords, because user's don't create strong passwords, they write them down, etc. His "solution" to that, is a system whereby users entire (for sites using this system) security is based on a single pair: email address, and a "master password" that, you guessed it - the user HAS TO REMEMBER. I'll leave you with one final though: if this ever gets any real-world usage, how long until bad actors start gaming the system, by presenting "Proceed with SecureLogin" buttons that show a dupe of the existing web UI to convince users to enter their email/password, and then hey presto, they have access to all SecureLogin-enabled sites that user has an account on. Edit: formatting.