> This step is commonly something like “enter the code in an email we just sent” when trying to login.
Because email is insecure, and there is zero guarantee that your login email will arrive before the token expires. Your token does expire, right?
> We are literally living through the gradual phase-out of third-party cookie.
Yes, and a "remember this device" uses a first-party cookie, so it isn't affected.
> My own browser erases all cookies from an origin immediately after the last tab from that origin is closed
So you are intentionally breaking the web and complaining that things are cumbersome? Gee, I wonder why.
> [..] yet that same website is happy to let me authenticate using an API key for API access as a single authentication step. No “2FA” here.
Yes, because that API key is often used to sign the request, contains enough entropy to make guessing impossible, and because the URL is hardcoded in the app phishing is impossible.
> guaranteed use of a high-entropy secret obviates the need for additional authentication
No, it does not. See: phishing.
Forcing the use of website-generated passwords is cute, but doing basic entropy checks on a user-provided password pretty much solves the issue anyways. Why bother alienating a significant fraction of your user base?
Authentication is pretty much a solved problem. Use a password locker encrypted using a single remembered key for the "something you know" part, and use a physical Webauthn token for the "something you have" part. Stop trying to reinvent the wheel, it'll only end up annoying your users.
Because email is insecure, and there is zero guarantee that your login email will arrive before the token expires. Your token does expire, right?
> We are literally living through the gradual phase-out of third-party cookie.
Yes, and a "remember this device" uses a first-party cookie, so it isn't affected.
> My own browser erases all cookies from an origin immediately after the last tab from that origin is closed
So you are intentionally breaking the web and complaining that things are cumbersome? Gee, I wonder why.
> [..] yet that same website is happy to let me authenticate using an API key for API access as a single authentication step. No “2FA” here.
Yes, because that API key is often used to sign the request, contains enough entropy to make guessing impossible, and because the URL is hardcoded in the app phishing is impossible.
> guaranteed use of a high-entropy secret obviates the need for additional authentication
No, it does not. See: phishing.
Forcing the use of website-generated passwords is cute, but doing basic entropy checks on a user-provided password pretty much solves the issue anyways. Why bother alienating a significant fraction of your user base?
Authentication is pretty much a solved problem. Use a password locker encrypted using a single remembered key for the "something you know" part, and use a physical Webauthn token for the "something you have" part. Stop trying to reinvent the wheel, it'll only end up annoying your users.