“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method.
I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.
I think the main problem is that SMS sender numbers can be easily spoofed (might depend on country, operator, …), so relying on “this message came from where it says it came from” is not really possible.
It might not be an issue for some types of usage, but sounds risky if used for account security/recovery/etc.
This is not specifically about Cloudflare’s “challenges“/etc, but —
The reality of operating a big site/service on the internet in 2022 is that it’s sometimes necessary to use methods that annoy a few people (with very non-standard browser settings) in order to protect the service as a whole from a million bots trying to attack it at any given time.
In Estonia, you can link a phone number to your IBAN. When making payments, the sender just needs a phone number, and the corresponding IBAN is automatically looked up. (The lookup service is managed by the central bank, and used by all (major) banks.)
But surely it’s possible to use methods other than what currently seems to be the first and only solution: “your account has been banned, bye”.
For example, if an automated system thinks an account is sending spam, enforcing a (very low) outgoing email rate limit would be a much more reasonable first step.
Maybe, but I would actually argue with the assumption that an image editor is somehow inherently (allowed to be) “more complicated and/or slow” than a productivity app.
Or, more simply: Slack (and other similar products) are not just “chat applications”.
When using a password manager you don't need to ”check the input” or “correct an error” or “see what characters have been typed" (the only ”usability problems” mentioned in the article)