> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery.
Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future.
People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password).
And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.
Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future.
People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password).
And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.