TPMs: exist
Hardware attestation: exists
MFA: exists
Every package repo and cloud service: Yo let's put one-factor access credentials in plaintext inside our working folder.
We gotta start using th...
@nprofile1q...
TPM and hardware attestation is pretty darned flaky on a lot of platforms. That's especially true for anyone running unconventional OSes and/or jailbroken platforms outside of the strict control of the major oligopolies (MS, Google, Apple), and disproportionately the case for people most likely to be developers.
A lot of this stuff is also automated in a way that makes MFA fundamentally more difficult. Not impossible, just more difficult.
Do I think this is a valid excuse for maintaining the demonstrably unsustainable status quo through intentional neglect? Absolutely not. But the otherwise obvious solutions are pretty tricky for a lot of use cases.
TPM and hardware attestation is pretty darned flaky on a lot of platforms. That's especially true for anyone running unconventional OSes and/or jailbroken platforms outside of the strict control of the major oligopolies (MS, Google, Apple), and disproportionately the case for people most likely to be developers.
A lot of this stuff is also automated in a way that makes MFA fundamentally more difficult. Not impossible, just more difficult.
Do I think this is a valid excuse for maintaining the demonstrably unsustainable status quo through intentional neglect? Absolutely not. But the otherwise obvious solutions are pretty tricky for a lot of use cases.
1