What is really crazy is that things that should be just an application locally installed on the device (such as PowerPoint) need a login at all.

There's a secondary issue of schools pushing children to use proprietary applications when perfectly serviceable alternatives exist (especially for school level work).

How the hell we all normalized this crap is maddening.

It's not even new. 20 years ago I got a bad grade in highschool because I used StarOffice and not Office 2003 for a project

My father and I had an unreasonably long conversation with the dean of students about how requiring someone to purchase a $300 software suite for a basic highschool English class was egregious

The school in the linked post actually requires 3 separate logins before you can see the presentation, that’s just…

One of the "best" parts being the first one of those was meant to be an "SSO" but apparently is design-by-committee and very bad at it. (Requiring too frequent logins, not saving usernames between logins [for kids?!], requiring login dances at downstream logins.)

> that’s just…

I think they call it UX.

Username/password is the easiest way to log in, assuming there is no stupid format requirements. It's just two strings stored in your password manager. The most retarded way to implement log in is actually magic email link, which requires opening your email client, waiting for the email to arrive, and copying the code. If you want to make it even worse, you can require that to be done using the same browser that is trying to log into the account.

[delayed]

Is it a slur if it's describing a process, rather than a person?

Yes.

There are still plenty of technical and scientific uses of the word in various forms, including retard, retarded, retardant, and retardation. One that’s in common use outside the sciences is “flame retardant”.

Technical usage, where the word is describing a quantity, process, or function include: retarded time, retarded position, retardation time, regarded coordinates, retarded Green’s function, retarded potential, retarded acceleration, and retarded ignition.

In all these cases, it’s used to refer to something whose progress is delayed or impeded in some way, which is the original meaning of the word “retard”, that also ended up being used in medicine and psychology and becoming a slur in those contexts.

So the correct answer to my original question is either “no” or “it depends”, with the latter requiring some qualifying criteria.

[delayed]

The correct answer is that the manner in which you used the word in the context above was as a slur. As you're no doubt well aware.

Full stop.

> the concept of the username/password is still so prevalent

How can you improve on it? You have the identity part and the auth part. What is better than that?

Passkeys. That has both and it can’t be set insecurely, written on paper or given to an Indian call centre who assures you they are from the finance department.

How do you identify whose passkey it is without an identity? They're a decent defensive auth method for people who can't use a password manager but they can't replace username/password.

username/passkey works just fine. No password needed. Nobody said drop usernames, the idea is drop passwords.

> the idea is drop passwords

and replace them with passwords (passkeys). Very clever.

Passkeys as they are currently-marketed are resident credentials. This means a passkey stored on your Yubikey (or smartphone, or Windows account, or...) is not only a private key, but also contains a UID to identify it. A website doing authentication can trivially use this to look up which user it is associated with. Very convenient for single-press login, but it requires a decent bunch of per-website storage on the hardware token. Which is of course a net positive for the big tech companies, because it forced you into using smartphones as the token, and doing silly things like cloud sync with them.

The original FIDO U2F credentials were not resident. You'd enter your username, and the website would sent over a bunch of opaque blobs representing the associated hardware tokens. The hardware token would decrypt their blob using a key derived from a combination of the website's domain name and the hardware token's single stored secret, and then do the whole auth shenanigans using the data retrieved from the blob.

Making it phishing-resistant, for starters. And having a built-in way to prevent people from reusing their password across multiple websites, so that any single compromise doesn't instantly turns into having all of their accounts pwned.

> And having a built-in way to prevent people from reusing their password across multiple websites

"Sign in with Google/Facebook/etc" - epic fail. /s

> Passkeys are sort of changing things,

Yeah, like changing poo with diarrhoea.