FIDO2 is already a mess: it takes an excellent model (U2F / physical custody) and makes it worse in ways ranging from annoying to dangerous: - in the typical m

FIDO2 is already a mess: it takes an excellent model (U2F / physical custody) and makes it worse in ways ranging from annoying to dangerous: - in the typical mundane case, its prescriptive about a PIN with the well-known bad outcomes on that - in the limit case, a bad guy who has already demonstrated a willingness to steal your credential now needs to threaten harm to get what he wants There's a reason bank tellers can't open the vault and a reason everyone knows that. Physical custody (U2F) is intuitive, maps extremely well onto existing infrastructure (everyone has keys for their car and home), scalable in security (safes are common, well understood, and can be made arbitrarily secure). So by the time you're at FIDO2 / demand a pin? Already user hostile. Strictly lockout increasing, strictly violence incentivizing. Moving right along, Webauthn could mandate trivial portability as a QR code, TOTP style seed, a zillion ways. Nope: vendor lock in battle (FireFox overlays its password thing on the same pixrls that the Proton or BitWarden one does that I turned on!). None of this is about security, none of it is about safety, none of it is about welfare. It's about money.