Quoting the docs: it’s “WebAuthn - without reading the w3c spec”. So apparently yes. It does seem very silly that this has to be a third party service instead o

Quoting the docs: it’s “WebAuthn - without reading the w3c spec”. So apparently yes. It does seem very silly that this has to be a third party service instead of open source code you just plug in to Rails or whatever. I guess they had to find some way to get paid for all the expertise they accumulated. Stuff running on external servers is the way tech companies as a whole have decided to remunerate work like that, and now everything looks like a nail. I note that since logging in is such a crucial part of online business, running consulting around open source software would appear to be a a good model. That’s what the people behind the C# OAuth2/OpenID code known as IdentityServer do.