[jrochkind1]

There are probably ways to make it reasonable UX, but they probably require built-in browser (or other client) support.

Someone in another part of this thread mentioned the "Web Authentication API" for browsers, which I'm not familiar with, but is possibly trying to approach this?

[tehbeard]

Web Auth API (authn) does try to make it usable.

It ties in with the credential management API (A way to have the browser store login credentials for a site, a much less heuristic based approach than autocomplete on forms) and basic principle is generate a key pair, pass back public key to be sent to server during registration. On login generate a challenge value for the client to sign. I don't think iirc the JS code ever sees the private key, only the browser sees it.

[jrochkind1]

How does Web Auth API and Credentials Management API address the "manage across multiple client devices" issue?

[kevin_thibedeau]

Useless unless browsers get their act together and encrypt their autocomplete data. I would never trust any API loosely associated with it.