Yes, I've seen that post. It's very misleading, to the point of being flat-out wrong. > Authentication and identification is combined This is plain false. The

Yes, I've seen that post. It's very misleading, to the point of being flat-out wrong. > Authentication and identification is combined This is plain false. There's nothing in the spec that says you can't give a site your email address, and there _is_ a built-in way to revoke credentials in the spec. > Single point of failure This is dumb. Password managers have exactly the same flaw and nobody seems to have a problem with that. > Social Engineering attacks This true, but only in exactly the same way that password managers are vulnerable. (If the user is for whatever reason not using a browser plugin to authenticate, _and_ you can trick them into entering their info on the wrong site.)