zlacker

>>foxfir+(OP)
I understand but it’s not always with bad intentions.

In the Netherlands we have a system called DigiD to login into to most government websites like your taxes and city, etc.

When I contracted for the city of Amsterdam I learned they’ve been pushing hard for the DigiD app to two factor authenticate instead of text message, because of contracts Digid charges a lot per text message validation and none for app.

>>wouldb+Ha
This could have just been TOTP.

>>msgode+af
TOTP standard made sense, but mainstream implementation was user-hostile at the start with stuff like Google Authenticator not letting you copy keys, then afterwards still making it unclear under what circumstances they're backed up. Nowadays it's user-unfriendly at best.

I like how we went full-circle to Passkeys which are basically a "remember me FOREVER" button, implemented kinda like SSH keys. Should call it that too, and also ditch the like 4 prompts it gives you first.

>>frollo+Cg
>"remember me FOREVER" button, implemented kinda like SSH keys.

Here's a better idea: just use openssh or at least openssh's key formats since none of the big companies can manage anything better.

>>msgode+4v
That would've been nice, cause instead Passkeys are kinda locked into whatever walled garden you chose.