Yeah, 2 is all I really care about. First-party discovery systems are almost always bad imo.

And every time I think about it for more than a second, I get mad that OpenID got eaten by OAuth.

I’m still mad that Mozillas persona got no adoption.

I’m sure it was imperfect, but in theory it was easy to host and easy to implement. :(

	▲	Groxx 12 hours ago \| parent [-]
		Completely agreed, it had essentially everything I wanted out of such a system. I think they would've nailed it if they had just integrated it into the browser / an extension, and I'm baffled that they left it in such an awkward state for the full run - almost smells like intentional burying. Revocation was hard, but it's not like existing systems are solving that in practice either, and you can get a long way by just keeping short leases (which is fine because nothing needs to communicate with any third party). If passkeys weren't so blatantly DRM-friendly I might like those, but they seem intentionally human-hostile for no good reason at all.