Damus
fiatjaf profile picture
fiatjaf
@fiatjaf
SQRL invented the anti-phishing public key cryptography based approach to website authentication many years ago. It was a beautiful spec of one page with multiple grassroots implementations.

Then they decided that the simple "I sign something with a key" approach wasn't good enough, they also had to cover a bazillion other key management things in the protocol so they brought a team of academics that turned the thing into a 300-page unreadable spec that no one ever implemented fully.

LNURL-auth basically reinvented the original simple SQRL version in 2019 and got many implementations and some traction within the bitcoiner realm.

But at the same time another team of academics probably by paid by some evil people were creating Webauthn, i.e. "passkeys", which solves the exact same problem and works in the exact same way, although this time the spec is much bigger than even the worst version of SQRL and apparently designed to create centralization.

It took them at least 6 years to get browsers and phones and some websites to start adopting this behemoth, but so far there are no answers to what is their real purpose or to the question: "what if I lose my phone?".

https://www.youtube.com/watch?v=xYfiOnufBSk
248❤️22🤙3☦️1❤️1🏴‍☠️1👀1
Matt 🛸 · 21w
I've avoided them. Bitwarden generated username, password, and the best available 2FA is good for me if I can't have something as simple as Nostr. Although that has concerns at the moment too (for me)
Tim Bouma · 21w
Yeah, “what if I lose my phone?” - that’s the key issue I identified. They want you to be dependent on your phone. The comeback is to store those passkeys in your platform account - in that case you are now chained to your account as well, and the security is only as good as access to your acc...
nicodemus · 21w
Ah, well that’s the trick: you don’t lose your key if you lose your phone. At least, not with the major players’ implementations. It syncs “with the cloud”, and you can simply buy a new device and auth with the same account to recover it. Yep. Simple password/secrets management. Password...
Jerome Powell 21iQ 40TPW · 21w
A password is something you can remember and type. A passkey is something that can be tied to a digital ID, which can later be used as a sort of internet passport. 🧐
CXPLAY · 21w
SQRL is basically unaccepted by any entity, and its authors are virtually impossible to fight against compared to the FIDO alliance behind WebAuthn (and that "Passkey").
(>0_0)> · 20w
I remember being quite excited about SQRL when it first came out. But I realized it was dead once Passkeys were announced.
Râu Cao ⚡ · 18w
Best practice (which is probably rarely followed) is to let users add multiple passkeys to the same account. That said, the level of lock-in they achieved by not letting you export anything and syncing only to a certain ecosystem's cloud servers in all big vendor implementations is completely over t...