<p><span class="h-card" translate="no"><a href="https://mastodon.social/@whitequark" class="u-url mention">@<span>whitequark</span></a></span> <span class="h-card" translate="no"><a href="https://hachyderm.io/@dalias" class="u-url mention">@<span>dalias</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@glyph" class="u-url mention">@<span>glyph</span></a></span> The thing I want out of passkeys is completely different from what Catherine wants out of passkeys, which is (I think) different from what Glyph wants! I want SPI. I want authentication without the shared secret (password) having to travel from its trusted home (whereever that is) to the authenticating party, thus hitting peril from lazy/malicious Twitter engineers, malwared Microsoft Windows, etc. Glyph wants anti-fishing. Catherine wants (I think) convenience. (3/4)</p>