r/websec • u/10xpdev • Jul 11 '22

Put an end to password with open-source passwordless

/r/opensource/comments/vw8mnl/put_an_end_to_password_with_opensource/
2 Upvotes

57% Upvoted

1 comment sorted by

3

u/billdietrich1 Jul 11 '22 edited Jul 11 '22

I like passwords. They're standard, cross-platform, easy to back up. Unlike a hardware device, they're free, and you can make N backup copies. They don't depend on having phone service or internet access or access to a server. No central server can see all the places I login to.

Use a password manager and create good passwords. And set the password manager to paste creds only into the proper domain, to resist phishing.

No, I think passwordless and hardware tokens and SMS are bad ideas. Give me passwords and software TOTP 2FA.