3 ms·
Credential stuffing would be a much less effective strategy is web apps went back to string-based usernames, and not email-based ones. Also, I hit CTRL-F on th
by jgalt212 2y ago
Credential stuffing would be a much less effective strategy is web apps went back to string-based usernames, and not email-based ones.
Also, I hit CTRL-F on this post for the term "portable", and I got zero hits. Both passwords and SSH keys are trivially portable. Not so much with WebAuthn passkeys.
- lxgr 2y agoLet's please not. Password recovery flows are hard enough to get right and usually suck; adding username recovery on top of that doubles the opportunity for locking legitimate users out.
- jgalt212 2y agoI don't know if I agree about the level of risk here. All password managers store passwords AND usernames.
- lxgr 2y agoHopefully it shouldn't take much to get there. Bitwarden/Vaultwarden already allows exporting the private key and (as far as I can tell) all other metadata required by another implementation to import them.