{"type":"rich","version":"1.0","title":"ChipTuner wrote","author_name":"ChipTuner (npub1qd…3fqm7)","author_url":"https://nostr.now/npub1qdjn8j4gwgmkj3k5un775nq6q3q7mguv5tvajstmkdsqdja2havq03fqm7","provider_name":"njump","provider_url":"https://nostr.now","html":"This article was intentionally emotionally misleading. It's public key crypto, most of us are here because we agree it's a pretty robust form of authentication. I do agree that big tech, after decades of the tech existing, decided, all at once, to mutate it and sell it to consumers. The mutation enhances security at the tradeoff of control and privacy. I do still think passwords work for things, and Id like to maintain responsibility for my accounts, I recognize no one else wants that responsibility. \n\nwebauthn has good standards, and can be used as 2fa, not primary in a totally portable and privacy conserving way. \n\ngenerally though, key portability comes at a security tradeof - making a key extract-able is an easy attack vector which is generally solved by storing multiple keys instead of moving keys between devices. \n\nthat said most people use their smartphone for all forms of 2fa - sms, totp, passkeys so nothing really changed. I wouldn't suggest anyone backup TOTP secrets but instead register multiple devices if possible, but that depends on the devices and the storage model. "}