[hn_throwaway_99]

Can't upvote this enough. People who say "we should all just use WebAuthn" need to understand:

1. Theoretically, they're right

2. Realistically, it feels like they've never interacted with the non-tech public, and all the issues and problems that need to be worked around with hardware keys.

There is a good reason companies are trying to move us to a "passwordless" future, but there is also a good reason they are going very slowly - they know there is no silver bullet.