Why Just Passwords?

When I met my wife, she was using the same Lord of the Rings-related password for everything. So I explained how if the most security-lax service she uses got hacked (exhibit A, B, C), all of her accounts could be trivially taken over. I also taught her how to use 1Password instead of memorizing passwords.

It used to take a lot of personal diligence to stay safe on the web. But these days, practicing safe password habits is easy for everyone to do because every browser/OS now automatically suggests and autofills passwords.

That said, hopefully one day, basic internet safety education is something everyone is taught in school.

It’s hard to think of a more confusingly introduced technology than Passkeys. They were promoted as a new safer alternative to passwords, but what they ended up being is a convenient additional way to sign in to an existing account, which still needs a password or OAuth provider.

Ideally it’s a liability developers wouldn’t need to have. But mature and boring encryption libraries (like bcrypt) and best practices like API rate-limiting are documented well-enough that providing safe password-based auth is not as intimidating as many developers think it is.

In the future, I’ll add optional 2FA support, which shouldn’t be too hard.

(For extra safety, I also prevent users from making passwords less than 4 characters long, and disallow passwords that match a part or whole of the email address. Which I’m told people still do sadly.)