If they could just use their fingerprint/faceID to login (after initial registration on the device) they would be super happy.
Rest of us should be happy there will be less exploits where people give up the keys to their kingdom by clicking on a random email.
If you scroll back, they mention you have to protect everyone to be effective, i.e. high value target friends and family.
Why is everyone yelling about the sky falling down when this is the best thing to happen to authentication since ever?
I was speaking very broadly. May have been a bit of a tangent.
All I'm saying is that authentication is literally the keys to the castle, and inviting third party control of authentication has some scary implications in terms of privacy, monopoly control, and security.
What drives me nuts is how little discussion of this I've seen. People don't even seem aware of the implications of it. It's being pushed hard as a boon to security, which it is in some cases, but at a cost that nobody is even considering or talking about.
I know where this is going. In a few years you'll have to pay a monthly fee to log into anything with your Google account, or Google will start logging into your stuff to harvest data to profile you. (Or both? Why not?)
I'm seeing a lot of new stuff pass on login/password or personal FIDO2 token auth entirely, meaning you can't even use stuff without delegating all authority to one of maybe two or three large companies. Even better I'm seeing OIDC-authenticated third party SaaS services managing SSH keys, giving both the service and the OIDC provider carte blanche shell login access.
Once we make this transition it's going to be well nigh impossible to go back. A few large companies are going to have root on the entire universe forever.