> I'm curious; why aren't we dropping the use of passwords in favor of U2F? Well, you are favoring U2F, which is a _specific_ _implementation_ of 2FA. U2F isn'

> I'm curious; why aren't we dropping the use of passwords in favor of U2F? Well, you are favoring U2F, which is a _specific_ _implementation_ of 2FA. U2F isn't being used generally, because it isn't a general purpose solution. > I guess for one; not everyone wants to buy and carry a key. This statement is the problem with looking at specific implementations to solve a general problem, instead of looking at all the solutions. There are many solutions, not all of which even use physical keys fobs. RSA is a straightforward example of why a 3rd party shouldn't automatically be trusted for auth mechanisms. > But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden. The burden isn't just a user side issue about carrying a fob. For general password replacement, key fobs will get lost. Passwords are a burden to the user, having to pay or deal with key fobs and their replacements will be an even greater burden. You are proposing to solve the auth problem by causing many users to stop using websites. Unfortunately, there are also issues with soft tokens. There are still applications that only use the "first soft token" in a list of soft tokens owned by a user. Plus, soft tokens are quite amenable to being copied. There are also many banks and credit card issuers who have consciously chosen various forms of 1.5FA instead of 2FA. In many cases this is a valid solution, a form of dual sided auth that works across all clients.