It is extremely annoying to me. Microsoft goes a similar way for authentication against a lot of their APIs. I dropped some of them because the maintenance isn'

It is extremely annoying to me. Microsoft goes a similar way for authentication against a lot of their APIs. I dropped some of them because the maintenance isn't worth the benefit anymore. I also don't want to register apps at them and don't want to wait until they acknowledge access. The market is too competitive for that. An overall it doesn't really add security to my threat model. A complicated authentication isn't necessarily a secure authentication. Given, passwords have to be handled with care, but any ssh key could just as well be scraped by the OS vendor as any password or by someone that compromised your system.