<story><title>Passwordless authentication with FIDO2–beyond just the web</title><url>https://lwn.net/SubscriberLink/923656/b15e2aa9b44ac718/</url></story><parent_chain><item><author>timwis</author><text>Can someone explain why people seem to be so happy with hardware tokens that they&amp;#x27;re okay with doing away with a password entirely? Doesn&amp;#x27;t that bring us back down to single factor authentication (now just &amp;#x27;something you have&amp;#x27;)? Or is the argument that if the majority of users only have a single factor anyway, hardware tokens are a better single factor than passwords, and that ideally everyone would still have two factors?</text></item></parent_chain><comment><author>lesuorac</author><text>Does nobody else here have an actual key to unlock their car &amp;#x2F; housing?&lt;p&gt;Like this was a solution that has worked for a long time. Sure houses&amp;#x2F;cars get broken into all the time but so do online accounts and judging my my spam mail, more people I know have had their online account hacked than their car&amp;#x2F;house broken into. And I know many more instances of people forgetting their password and reseting it than them locking their keys in the car.</text></comment>
<story><title>Passwordless authentication with FIDO2–beyond just the web</title><url>https://lwn.net/SubscriberLink/923656/b15e2aa9b44ac718/</url></story><parent_chain><item><author>timwis</author><text>Can someone explain why people seem to be so happy with hardware tokens that they&amp;#x27;re okay with doing away with a password entirely? Doesn&amp;#x27;t that bring us back down to single factor authentication (now just &amp;#x27;something you have&amp;#x27;)? Or is the argument that if the majority of users only have a single factor anyway, hardware tokens are a better single factor than passwords, and that ideally everyone would still have two factors?</text></item></parent_chain><comment><author>michaelt</author><text>There is a standardisation process with multiple stakeholders.&lt;p&gt;Some stakeholders want hardware devices that are secure even if the OS has been completely compromised - even if they have to trade off usability and price to achieve it.&lt;p&gt;Other stakeholders think iPhone biometrics are pretty great, and if you&amp;#x27;ve logged in with full credentials and indicated indicate the phone is trusted, going forward the combination of recognised phone + biometrics is good enough, even if it doesn&amp;#x27;t secure against a compromised OS.&lt;p&gt;And in a spirit of standardisation and vendor independence, if iphone face recognition is good enough, why shouldn&amp;#x27;t the face recognition on a phone from Honest Abraham&amp;#x27;s Used Cars And Android Phones also be good enough?&lt;p&gt;It is the latter group of stakeholders that are currently ascendant.</text></comment>