Personally, I use Yubikey or TOTP (with RedHat’s FreeOTP) for everything. But that can only work if most services you’re using are using SSO, and you rarely ne

Personally, I use Yubikey or TOTP (with RedHat’s FreeOTP) for everything. But that can only work if most services you’re using are using SSO, and you rarely need to reauth. I need to reauth every time I log in, every time I want to authorize a new service, or modify server, DNS or storage settings. This only works well because I’m self-hosting 90% of the services I use, and they use a Keycloak as identity provider, and then don’t have to handle identity themselves. This is why I’d prefer to see more identity federation – ideally the tokens the services see are short-lived, but the user doesn’t have to re-login every time either.