It has negative security. Log me in for a fucking month, stop wasting a minute of my time every day!
It's also a great way to lose everything if you happen to lose your phone or laptop and it gets found a few hours or a day later and the antagonistic finder guesses your weak PIN.
In the US, service providers and manufacturers are often held liable for losses if they make something that has sub-standard security. Kia, for example, was held liable for making their cars too easy to steal. Banks have boatloads of things they have to do to protect their customers.
It's not really your choice to take the risk here, apparently.
And even with Gmail there's a decent chance it isn't just "blindly trust unlimited-duration token". Cookie stealing is now one of the main forms of credential compromise, so I bet there's some form of browser and/or IP verification going on to demand a reauth when some `curl` instance from a Russian VM tries to make use of it...
Of course, in practice that would just turn cookie-stealer malware into request-proxying malware.
There's a secondary issue of schools pushing children to use proprietary applications when perfectly serviceable alternatives exist (especially for school level work).
How the hell we all normalized this crap is maddening.
My father and I had an unreasonably long conversation with the dean of students about how requiring someone to purchase a $300 software suite for a basic highschool English class was egregious
I think they call it UX.
Technical usage, where the word is describing a quantity, process, or function include: retarded time, retarded position, retardation time, regarded coordinates, retarded Green’s function, retarded potential, retarded acceleration, and retarded ignition.
In all these cases, it’s used to refer to something whose progress is delayed or impeded in some way, which is the original meaning of the word “retard”, that also ended up being used in medicine and psychology and becoming a slur in those contexts.
So the correct answer to my original question is either “no” or “it depends”, with the latter requiring some qualifying criteria.
Full stop.
How can you improve on it? You have the identity part and the auth part. What is better than that?
and replace them with passwords (passkeys). Very clever.
The original FIDO U2F credentials were not resident. You'd enter your username, and the website would sent over a bunch of opaque blobs representing the associated hardware tokens. The hardware token would decrypt their blob using a key derived from a combination of the website's domain name and the hardware token's single stored secret, and then do the whole auth shenanigans using the data retrieved from the blob.
"Sign in with Google/Facebook/etc" - epic fail. /s
Yeah, like changing poo with diarrhoea.
And it doesn't escape my notice that all the fucking things I have to log into over and over and over are using Microsoft auth. Which granted, I think every office worker would notice that just from the ubiquity of their software, but still. And, on top of it, Microsoft's login flows are remarkably, consistently clunky. The forms jump all over the place and it has to refresh the page like 5 times as it's processing your credentials, and lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end. Like I dunno personally I wouldn't get a security token until the user has actually interacted in some way with the stupid form but what do I know I've only been making software for like 13 fucking years.
Oh yeah, bonus points: I use the passkey thing for my MS Auth app on my phone, and every single goddamned time I sign in, it asks me if I want to.... wait for it... create a passkey.
Just, truly the biggest circus with the most clowns over there.
Whenever I see the Outlook auth box I mash in some gibberish for my password to immediately get the "expired" notice so that I can enter my real auth info.
So if any admin happens to look, my baseline for incorrect passwords entered is 50%.
If you look that up you'll see that people have been encountering that for over a decade.
I simply and truly don't get it.
Microsoft must have at least 80.000 devs. No one there ever wanted to fix this?
If I ever have to manually fill anything in, it is almost certainly going to be a phishing attempt. It immediately jumps out as "this is unusual, something is wrong here".
The only thing which bothers me is email login links, but luckily I don't daily any apps which use them.
A few examples that happen pretty much every day:
1) The teams interface takes upwards of 60 seconds to load, from the moment I've gone through the auth process and the Teams logo pops up, from when the UI actually renders the sidebars and the first chat window.
2) It frequently fails to load new messages after resuming an existing session for a few minutes. It shows everything up to date, you can navigate between chats, but no new messages or unread message counts update. Sometimes this takes a few minutes, then it suddenly works, but it's impossible to tell if it's working and you don't actually have any messages or if it's in this limbo state.
3) When you need to reauth, the app seems to work, again showing all the previous messages, but there's this tiny toast at the top saying that you need to log out.
4) The log out button doesn't actually work. On Chrome, I've had to use devtools to clear my cookies & sessions for it to get into a valid state where it would actually let me sign in again. The Mac app just goes unresponsive and needs to be forced to quit.