What I've argued for for a long time are passkeys that are outside of the browser.
I want asymmetric cryptography and for the target site to not actually have my password to potentially leak it. In theory a software as convenient as a password manager could help you sign a signin phrase the site gives you. And further in theory, that software could be built into the browser so non-tech people don't even need to know it's happening.
It's that last concept that's the problem. That's what they did. They went one step too far along a series of improvements. And so the passkey doesn't feel like something you own or manage or have control over because it's the site's JS and it's access to the browser APIs that are managing it for you. But then you don't own it. Their JS does.
The very first sign-in module I wrote, same one used here, was built to have a bitcoin signin. If you had a classic bitcoin wallet with a single address you could share your bitcoin address as a signin credential and then sign in by signing a phrase with your wallet. Technically that code is still there. I just struggled to find UI I liked for it.
That was back before multi-wallets were the standard and expecting to know your primary bitcoin address was reasonable.
Bitcoin is 17 years old. We've had the ideal tech for signins for a long time. But boomers don't want to use a second application. And tech companies don't want you to use a second application. And the people who want both security and freedom are a minority. Plus it's not the only possible solution so we end up diluted across 10 or so acceptable standards. "I don't want bitcoin I want blank." And the only one standard among 10 that gets some marketing behind it and companies supporting it is the one where you loose more control and the details are obscured from your understanding and influence.
Log in
Passwords make me feel less in control. I need to feel in control so I resort to remembering all my passwords.
*Safewords
What I've argued for for a long time are passkeys that are outside of the browser.
I want asymmetric cryptography and for the target site to not actually have my password to potentially leak it. In theory a software as convenient as a password manager could help you sign a signin phrase the site gives you. And further in theory, that software could be built into the browser so non-tech people don't even need to know it's happening.
It's that last concept that's the problem. That's what they did. They went one step too far along a series of improvements. And so the passkey doesn't feel like something you own or manage or have control over because it's the site's JS and it's access to the browser APIs that are managing it for you. But then you don't own it. Their JS does.
The very first sign-in module I wrote, same one used here, was built to have a bitcoin signin. If you had a classic bitcoin wallet with a single address you could share your bitcoin address as a signin credential and then sign in by signing a phrase with your wallet. Technically that code is still there. I just struggled to find UI I liked for it.
That was back before multi-wallets were the standard and expecting to know your primary bitcoin address was reasonable.
Bitcoin is 17 years old. We've had the ideal tech for signins for a long time. But boomers don't want to use a second application. And tech companies don't want you to use a second application. And the people who want both security and freedom are a minority. Plus it's not the only possible solution so we end up diluted across 10 or so acceptable standards. "I don't want bitcoin I want blank." And the only one standard among 10 that gets some marketing behind it and companies supporting it is the one where you loose more control and the details are obscured from your understanding and influence.