the problem is the threat models for different sites and apps aren't the same, and so security protocols that cover the maximum bases for compliance, identity,

the problem is the threat models for different sites and apps aren't the same, and so security protocols that cover the maximum bases for compliance, identity, security, privacy, recovery, and moderation don't have a lot of flexibility. the only thing that is going to change authentication is a new mode for working online and the death of the browser from AI rendering most of what we need. maybe this polarizes, where on one end you have the resurgence of TUIs that raise the technical bar and normalize cryptography and key management for tech work, and at the other we have AI interfaces using a kind of real time biometric context, mediated by some opaque hardware integration. I would be surprised if we're still typing passwds and TOTP tokens in as little as 10 years.