My biggest problem with webauthn, it REQUIRES javascript. I know it's 2022 and everyone just throws the JS security issues under the rug and pretends that runni

My biggest problem with webauthn, it REQUIRES javascript. I know it's 2022 and everyone just throws the JS security issues under the rug and pretends that running JS for security is 100% totally awesome. Yes you can mitigate the security issues a lot with a myriad of security headers, that still doesn't mean you aren't expanding your threat model a lot by enabling JS for authentication.