> Does even anybody remember the good old HTTP basic acess authentification? old, yes. good, no. * Browsers never implemented a way to "log out", so creds end

> Does even anybody remember the good old HTTP basic acess authentification? old, yes. good, no. * Browsers never implemented a way to "log out", so creds end up cached in memory until the browser is restarted. * There is no concept of a session so the credentials need to be included in each request and verified every time. If you use something like bcrypt or pbkdf2 on the backend that means every request will take hundreds of milliseconds. * Since every request needs to be verified you can't easily use 2FA, without ugly hacks that 'remember' that the earlier creds were valid. Hopefully things like WebAuthn will result in a resurgence of browser native autentication.