Hacker News Reader

A closed-firmware USB key is really no better option.

Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?

No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.

There's open source ones. Nitro keys are what I've been using and they're basically flawless.

The issue is that operators can just curate a whitelist of authenticators they like. They could opt to not allow Yubikeys if they wanted.

Not only are Yubikeys agnostic, they cleanly slip from host to guest and present exactly as you expect, without a technical fight. Passkeys? I assume they could do this in a few years..