It’s time to replace passwords with keys

Keys can be equally as dangerous as passwords if not managed correctly. Public keys, even more so. What systems and accounts trust my public key? Who knows? What is managing and mapping that? Did I have sudo for a while and shove my public key into your authorized_keys file? Are your ssh instances using the default location for authorized_keys that users can write to? Is this appropriate in your use case? Certainly not for production machines, right?

Do you rotate your ssh keys that are used in automation? Are your keys limited to specific CIDR blocks? etc... things to consider.

It's mission is to bring public key cryptography to the masses, starting with programmers. The amount of progress that they've made in the last two years is actually quite impressive.

This is like walking in a room, seeing a tiny speck of red paint on the wall and saying that the wall is painted red.

Virtually everyone who owns a computer uses passwords, and probably 0.1-1% use a password manager. The others manage the passwords with memorization or post-it-notes just fine. Sometimes they forget, but email password resets solve that problem.

They're not trivial for developers, but you shouldn't care about that. You should care about the end result and UX.

Passwords are simple. No alternative is better because it's a solved problem. End of story.

I wish Tesla would adopt U2F. They already have something that seems to be BLE/NFC for the Model 3.