alt Hacker NewsThis is exactly all the stuff normal people don't care about.
If your system requires any basic intelligence or interest scrap it and go back to the drawing board because you just lost your customers.
Replies
thewebguyd • yesterday at 6:36 PM
I mean, no one ever said it was a good design.
But the original FIDO2 standard wasn't made with consumers in mind in the first place, it was driven by enterprises that wanted high-assurance security. It works in that environment because, well, a big IT department controls it, can support the employees, and you can mandate and control its use.
It was just sort of haphazardly shoehorned onto general users/consumers, prematurely IMO, via synced credentials as a compromise instead of coming up with something better.
Stronger than "don't care about" (at least if I and some friends I've discussed this with count as normal people): this is actively what I don't want! I want control over my authentication and I don't want it bound to device, browser, OS, etc.