How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.

Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.

It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.

▲

phoghed 2 hours ago | parent [-]

and your bank can't force a certain client for a password if they decide to? or that you need to drink a confirmation can? or whatever arbitrary technical constraints they want to do in general?

anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.

	▲	NoidFonsense 2 hours ago \| parent [-]
		They effectively can't to the extent that it's not a social norm to enforce that level of security theater. You are arguing in favor of normalizing an increased degree of security theater. My point here is that this specific step on the slippery slope is a cliff, not some infintessimal change, because now the authentication is done through a program and not copyable information. If verification-can technology is standardized on an OS level and advocated by four out of five tech priests (and maybe even enshrined in law (think of the children)), then you are going to be drinking a whole lot more mountain dew in the future to say the least. If it was just a single bank or something that tried this, people would get pissed off, leave, and the frog would not be boiled. It takes a slow industry-wide movement to shift the standards of what is acceptible to the common man.