Simple passwordless authentication for web projects

Re:Simple passwordless authentication for web projects by tialaramex on Tuesday February 22, 2022 @12:46PM (#30430935)

> My point is that I think that there are significant upsides to passwords and most of the downsides can be worked around such that users would barely notice the difference.

That's barely a "point" and more an abstract notion that you're correct although you're aware the evidence suggests otherwise. The supposed "strengths" of passwords are in tension with any attempts, like yours, to make them actually useful for authentication. We have something that actually works, today, WebAuthn. If you care about the authentication problem use WebAuthn.

[ Parent | on HN ]

Re:Simple passwordless authentication for web projects by kevincox on Tuesday February 22, 2022 @12:52PM (#30431007)

Maybe I haven't seen a good implementation but I wouldn't say WebAuthn works. I have yet to seen a version that syncs across devices which is a fundamental requirement for me. I'm also not sure how I can type in a WebAuthn credential to someone else's computer or how I can memorize it so that I can use it when I am away from my phone+computer.

Both approaches clearly have gaps right now, all I am saying is that long term I think the password+PAKE looks more promising than what WebAuthn offers.

[ Parent | on HN ]