3 ms·
> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd facto
by amluto 2y ago
> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor.
A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.
- deleted 2y ago[deleted]
- jampekka 2y ago> Let’s not make an inferior solution mandatory when we already have a superior solution. With a slight caveat that it doesn't work. At least not on Linux without some proprietary junk dongles or their emulators.
- mixmastamyk 2y agoHuh, can you be more specific? I thought I was using this on Linux with bitwarden. Is a yubikey “junk?”
- jampekka 2y agoSoftware/OS passkeys weren't supported, at least not well enough for Github, on Linux when I last tried. Per web search they still don't. Stuff that I could do without, like a yubikey, is junk in my books.
- mixmastamyk 2y agoBitwarden supports, may be beta. Passkeys are usually controlled by corporate controlled devices—why I haven’t used them yet. See: https://news.ycombinator.com/item?id=39698502 https://news.ycombinator.com/item?id=39698502 Keeping the storage separate (or not) from the device may not be important to you but keys are useful to some, for that reason.