dyml

Hey… if you weren't aware, the HN guidelines now include: > Don't post generated comments or AI-edited comments. HN is for conversation between humans.

I also used Kagi, but decided to cancel my subscription last year when it was revealed they pay Yandex for their search, which is a Russian company that ultimately fuels the Russian war on Ukraine.

Once Kagi stops transferring money to Russia, I’d be happy re-subscribe.

I work at bitwarden and I can confirm this. While technically you have the data, any other app need to support our json format (which they totally can, our code is open source) - but CXP (the standard) is happening this year so we’re planning on using it.

I worked on this standard and we’re all excited that it’s rolling out to most of not all password managers and platforms.

We're enabling it by default, you can opt-out.

I just want to point out that the title is wrong. 2FA is on by default, but not mandatory. Dang, can we change the title?

I work at Bitwarden and I have that same pet peeve! Let's see if I can get a PR up without causing a UX stir :)

Very unfortunate and caused me to cancel my subscription immediately. Any alternatives that people can recommend to someone who throughly enjoyed Kagi?

I really hope they reconsider their arrangement.

Please don’t use WebAuthn on every page load.

Two reasons: the protocol is not designed to do this - and the UI/UX is not designed to support this. There are better ways.

2) it will likely not work. There are virtual/software authenticatators (available in dev tools) that could generate a valid response without a human.

Use a password manager, like Bitwarden

Send an email to me at [email protected] and I’ll look into it!

Good feedback, thanks! will bring it up when I’m back at work

Very soon

You can use any passkey provider app. I work at Bitwarden and we’re building mobile passkeys for android right now. We can do the e2e sync, but if you want you can always self host Bitwarden server and just use our clients app.

You make a valid point about “non-resident” WebAuthn 2FA being great 2FA. However, passkeys are also great, and they depend on your context…. Most people are in the passkey context.

For people who are not knee-deep I think we can explain it a bit better, why passkeys replaces passwords:

With non-resident (2FA keys) you need to identify your account first. Since you don’t want to have account enumeration, this means doing a primary authentication, e.g. passwords.

With passkeys, the website can just ask your browser) to sign in with any of the accounts it has passkeys for; which result in a one click sign in.

While hardware backed Security Keys for 2FA is great 2FA, there’s a tangible cost, both in UX and $ that leaves many users left out (not everyone can afford $20 for a security key)

Source: I work at Bitwarden building our Passkey API for developers. We support both 2FA and passkeys, both in the API service and in our password manager. Feel free to ask my anything related.