Hacker News Reader

It's a solid case for FIDO2 keys.

- Inherent MFA that is faster and more secure than SMS codes, or app notifications.

- One pin code and/or biometric to remember rather than hundreds.

The answer isn't to add another layer of management to passwords, but to eliminate passwords as a method of authentication.

View on HN

This. This is the only thing that actually solves all warts of authentication nowadays. Companies really should switch to a webauthn-first mindset. The technology has been here for over a decade, it's not new. There is a standrad and a library for every language, it's not hard. FIDO2 keys start at 20 bucks and every android phone can act as one, it's not expensive. They are literally the only thing that can actually protect you from phishing and they generate new login creds per domain, protecting your privacy. Companies, support webauthn!

I find those keys immensely inconvenient, though. I used them for a couple of years, but finally gave up and went back to long, randomly-generated passwords.

Reply on news.ycombinator.com