Did any of the critics making unsubstantiated claims like this even bother to read the Working Group mailing lists where people are discussing the security and

Did any of the critics making unsubstantiated claims like this even bother to read the Working Group mailing lists where people are discussing the security and privacy requirements of these APIs? These specs are being developed in the open, with input from organizations like Mozilla and security engineers from all over. If you have a specific claim, you can reference the spec and make it. Also, the whole point of the "silly web authentication API" is to do away with passwords and usernames, and let users supply authenticated credentials, which would enable -- if desired -- creation of as many user credentials as you like, without having to tie everything to your email + password, which could make it a lot easier for people to have many different identities that can't be linked between sites, as well as make it easy to create 'throwaway' identities. This 'silly' API doesn't increase data collection, it simply fixes some of the biggest problems with web security: passwords and 2-factor authentication. This is the tech equivalent of the following fallacious kneejerk reasoning you see in anti-vaxxers: "big pharmaceutics/Monsanto is evil, therefore since big pharma also makes vaccines, any new vaccines that comes out is bad because they just want your money." This kind of knee-jerk conspiracy theory stuff doesn't help public health and isn't linked to any specific claim. If you've got a specific technical critique of a new spec, you should make it, but to dismiss a new security API as "silly" is a non-sequitur.