And what’s left is essentially wireguard for logins. People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. Yeah there are valid criticisms and I’ve critiqued the work as well in other comments. But the “this is utter shit how could anyone imagine this is a valid idea” is not productive.
> Honestly, this discussion isn’t worth the time.
That’s my point. If it’s not worth your time then let others who are interested discuss rather than just pissing all over the author’s project.
> - Softkeys are available—in fact, iOS, Android, MacOS, and Windows 11 all do webauthn by default, without the need for a hardware token.
That’s not soft keys it’s “platform authenticator”.
When I say softkeys I mean keys managed by a user agent such that they can be portable, like is common with ssh. SSH is popular because it’s gives users the freedom to easily elect their security posture: do they want a user key that can be deployed to different devices or are they super paranoid and want a device key. Do they want a software agent to manage soft keys for them and it can handle the device security and hardware crypto engine support. Not your concern, not the protocols concern, not the services concern: it’s the user’s concern.
Wireguard has soft keys, too.
WebAuthn’s crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. That’s the problem.