> aren't we largely back to passwords? Key based authentication is a huge security improvement over passwords (especially for reducing phishing risks) even wit

> aren't we largely back to passwords? Key based authentication is a huge security improvement over passwords (especially for reducing phishing risks) even without the device-bound restrictions. I'm strongly opposed to hardware-bound keys as a mass standard for most users, but key based authentication is great. One big advantage is that during the login process, sites "prove" their identity to you. This is a security improvement that you could previously only really get with browser extensions and password managers, and even there it wasn't great because those extensions didn't work consistently across all sites and often failed at autofill, so a website failing to pull up your password manager might not actually be interpreted as a red flag. And there are other advantages too around account security for service providers, etc... none of which require attestation or hardware-bound keys.