2 ms·
It doesn’t provide any benefit to site operators. There are no punishments, drawbacks, or sticks to prevent web operators from shrugging off and ignoring WebAut
by altairprime 4y ago
It doesn’t provide any benefit to site operators. There are no punishments, drawbacks, or sticks to prevent web operators from shrugging off and ignoring WebAuthn in favor of implementing the bargain basement choice, user/password.
Sign in with WebAuthn via hardware touch sensors is incredibly effective, but is also not an option for a considerable fraction of each site’s users. So it’ll always have to be a second method, not a first, and it comes with privacy hindrances for the greedy (think: Apple Private Relay integrated UI).
Browsers would need to start presenting security warnings for classical password autofill to push adoption to the next level.
- turnsout 4y agoEventually the goal would be to remove username & password altogether. That would be MUCH simpler for developers. No email integration for forgot password flows, no need to hash and store credentials, etc. WebAuthn is dramatically easier to implement than passwords.
- altairprime 4y agoWhat will folks accessing sites at a library do? They can’t access their cloud account, it’s a library computer.
- tough 4y agoSpin up a VM to use ?