On things I care about I used U2F (Yubikey) which as a second factor is ideal. People trying to break into an account won't have my U2F device and fail. (I've seen them try this). Google's support of U2F devices sucks. Like really badly. But they seem to get that these things are safer than "passwords" that are reversible with rainbow tables. Now they are all about "passkeys" which they STORE ON YOUR DAMN COMPUTER OR PHONE.
Here is where I fall off the boat. If we learned EXACTLY ONE THING from the Crypto Coin world it was this, if you put something valuable on your computer or your phone, PEOPLE WILL WORK DILIGENTLY TO STEAL IT. Often in creative ways like otherwise silent drive by clickless exploits in browsers delivered by Ad Networks.
What part of "Good security is security where you don't get to run code on the device providing the security, ever." did they miss?
Here is where I fall off the boat. If we learned EXACTLY ONE THING from the Crypto Coin world it was this, if you put something valuable on your computer or your phone, PEOPLE WILL WORK DILIGENTLY TO STEAL IT. Often in creative ways like otherwise silent drive by clickless exploits in browsers delivered by Ad Networks.
What part of "Good security is security where you don't get to run code on the device providing the security, ever." did they miss?
I am completely at a loss to explain this fail.