This article says nothing.

In practice, operationally, none of this is solved. Every website/app/platform handles logins differently. Some are still doing SMS 2FA, some still do passwords, some implemented passkeys in the wrong way, some are doing app based MFA, some are doing magic links, some are doing email codes.

You can't in good faith say this is "solved" when it's just more complicated than ever, and the UX is terrible (passkeys, cough)

▲

patja 17 hours ago | parent | next [-]

The article has quite a bit of "me, me, me, I, I, I" self-promotional content. Which makes sense given it is an advertisement for his book.

I find it jarring to hear that authentication is "largely solved" by passkeys and FIDO, technology that a very very small minority of applications support. Making claims like this combined with the focus on self-promotion is a quick path to being dismissed and ignored.

	▲	robalfonso 16 hours ago \| parent [-]
		Agreed, this is like the lead the horse to water issue. Yes the water exists, no one is really drinking it yet.

▲

hn993302 16 hours ago | parent | prev [-]

Yep, the king is currently SMS, which isn't good.

I like passkeys, but somewhere between websites and browsers, even those aren't used in a consistent way. And idk why there are so many prompts before you're actually logged in with one. The name is also unclear.

TOTP is way worse. It used to be kinda synonymous with Google Authenticator which had insane footguns for losing your codes. Now it's just inconsistent and weird. Like I was trying to set up Github 2FA with 1password, it wanted me to scan a QR code with the browser extension, that wasn't working, so I had to copy some other code instead and paste it into some deep hidden menu of 1password that I needed a tutorial to find. I almost did SMS instead. Most people probably will.

Also don't know why Github requires TOTP or SMS even if you already have a passkey. Probably goes back to passkeys not being mature yet.

▲

jimz 16 hours ago | parent [-]

A very odd real example is how Sony went backwards with passkey compatibility on their apps. It's I think what happened when they tried to have a single OIDC setup instead of multiple (PSN was a totally separate setup for the longest time and had it solved, but other parts of Sony, on a separate system, was almost wholly incompatible. The merging of the two made it impossible for their current webkit implementations to detect passkeys in say your 1password when it was working like a charming for years on PSN). This kind of stuff happens but to put it into production when it's almost immediately obvious that they screwed up is pretty wild.

	▲	hn993302 14 hours ago \| parent [-]
		That's a more likely explanation for the Github passkey vs TOTP thing too.