The author has enough knowledge to be dangerous and shouldn't be allowed anywhere near an authentication system. The first diatribe against 'nondeterminstic' l

The author has enough knowledge to be dangerous and shouldn't be allowed anywhere near an authentication system. The first diatribe against 'nondeterminstic' logins demonstrates a naivety to both account takeover and botting mitigations. Passwords have to be assumed to be low entropy long lived credentials which are horrible from nearly every standpoint. API keys at least have a high entropy but are long lived and difficult to secure. (How many times do we need to see apikeys accidently leaked in a pull request?). They also do nothing from a phishing perspective. OTP is a high entropy and the authenticated credential exchanged has a very short lifetime. The exchanged credential may also be much shorter. It is still susceptible to phishing mitm attacks. Thankfully it's 2023 and webauthn is here for the browser. We can keep long lived secrets in a secured environment, be resistant to phishing and if the risk model includes physical loss of device utilize pins / passwords even if they are low entropy.