3 ms·

100% agree. Passwords + OTPs are the best solution, IMO. No big tech can control this, and it's easy to keep a grasp on all the credentials we have. WebAuthn?

• formerly_proven 2y ago
  How does big tech exert control over your usage of WebAuthn?
  • eadmund 2y ago
    By enabling relying parties to blacklist or whitelist the devices their users are allowed to use. It’s one more brick in the wall preventing general-purpose computing. Want to authenticate to Banana Computers? Well, you have to use one of their oDevices, because they will not let you use a RoboPhone to store your passkeys.
    • lxgr 2y ago
      You seem to be thinking of attestation, which is not a thing anymore with at least Apple's and Google's implementation. (They both had it for their non-synchronizing device-bound authenticators, but have heavily or even entirely rolled that back in favor of passkeys.) And since any solution excluding either of these is a non-starter, ironically the passkey push has made WebAuthN more open when it comes to client choice. So while I agree that Apple and Google not allowing passkey exports (yet; I am cautiously optimistic that they'll eventually be pushed to offer that too) runs the risk of locking in non-sophisticated users, the future is looking very bright for everybody posting here at least.
    • growse 2y ago
      Yeah, you're missing the point of why attestation is in the spec in the first place. Show me a widely available service that filters authenticators based on attestation attributes?