U2F can't spread fast enough. For about a year or so it's been good enough that almost all U2F keys Just Work on all major browsers / platforms without installa

U2F can't spread fast enough. For about a year or so it's been good enough that almost all U2F keys Just Work on all major browsers / platforms without installation or tweaks. That's huge, and it's actually a relatively recent state of affairs. I believe Firefox defaulted it to enabled ~1 year ago. The next big hurdles are getting support from e.g. banks, getting keys into peoples' hands, and getting people familiar with them. Those efforts are underway in the corporate world and I am optimistic that they will cross-pollinate well into personal security. HN-ers are well positioned to help with all of these steps. People already accept that they should lock their front doors and their cars with keys. Most people already lug a keychain around. I don't think it will be steady-state problematic to convince people to secure their bank accounts and email with keys. Example: my parents. I expected it to be difficult to convince them that they should use a U2F key to secure their gmail. It wasn't. Their response was more along the lines "of course we should use keys, why weren't we doing this before?" They don't know anything about crypto, but they get the metaphor, and since it gives them a clear path to action, they are willing to engage with it. The answer to why we weren't doing it before is that the previous implementations were a PITA in a way that U2F isn't (TOTP was slow and fiddly, ISO7816 required non-portable setup), but now that we have U2F, I think people will be more willing than many here expect. If we can channel the fear of SIM swaps into U2F adoption, I think it actually stands a chance.