[eMGm4D0zgUAVXc7]

> It's very hard to make a privacy case against FIDO.

With username and password, I have full control over my privacy in a very easy to understand fashion: If I randomly generate them I know I cannot be tracked (as long as I ensure my browser doesn't allow it by other means).

With those keys I have a opaque piece of hardware which transfers an opaque set of data to each website I use and I have NO idea what data that is because I do not manually type it in. I need to trust the hardware.

Sure, I could read the standard, but it very likely is complex enough that it is impossible to understand and trust for someone who has no crypto background.

And I also have no guarantee that the hardware obeys the standard. It might violate it in a way which makes tracking possible. Which is rather likely, because why else would big tech companies push this if it didn't benefit them in some way?

[anthony_r]

> Which is rather likely, because why else would big tech companies push this if it didn't benefit them in some way?

They switched to this internally a long time ago which basically eliminated phishing attacks against employees. There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers, and non trivial resources to accomplish that. Not everything is a conspiracy.

Also, I am sure you will be able to stick to just passwords for a pretty long time while the world moves on to cryptographic authentication. I'm not being sarcastic here.

[matheusmoreira]

> There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers

The same corporations that routinely intercept all network traffic.

[danuker]

> There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers

Said security teams have at most zero incentive that the privacy of the policy subjects is preserved.

[raxxorraxor]

Yes, they also track the behavior of their employees. It is security for them and not for the user in many cases. In a perfect world those incentives align but they don't have to.

[judge2020]

> I need to trust the hardware.

With your password manager, you're trusting a lot more: the software of the OS and kernel, the software of the browser and its dependencies, the software of your password generator and your password storage. You also have to hope the developers and administrators of the website you're signing in to aren't storing your passwords in plain text (and I don't just mean in the database - overly-aggressive APM/logging might be storing POST request data in a log stream somewhere).

The only attack that's an issue for both passwords and security key-based sign-in is targeted attacks against a website, where they use your browser to execute malicious API calls to the website after you've signed in regularly.

[oynqr]

How about using one of the open hardware + open software security keys?

[pnt12]

I'm not familiar with FIDO, but passwords place a lot of effort into the user (must avoid repeating them, must avoid simple sequences, etc). After years of warnings, this has berely changed - people use lousy passwords and repeat them.

So I'm all up for considering different approaches.

[kccqzy]

I think you brought up something very important: explainability.