Count me in, please.
This post is slightly off topic. As a system administrator, my two favorite advances over the years have been package management (yum/apt) and passkey authentication. As pointed out in the article, passkeys are simply more secure. Passkey authentication doesn’t send your private key across to the server.
As an administrator I’ve had password authentication for SSH disabled for years. Did people complain? Of course, that’s what they do. They complained when they were forced from telnet to SSH. It’s new. It’s different. It’s difficult. And my favorite, I can’t get my work done now.
Now I can deploy new servers in minutes using configuration management tools that creates accounts with the user’s public key. No more creating passwords, setting force change on initial login and sending them securely to the end user. The teams I work with now have no issues with public keys.
With regards to web site authentication. We forget that passwords had/have their own learning curve. Attempting to create a new account for a website was like inserting a USB key; takes 3 tries. Ever enter a USERID and have “not unique” returned. Resolve that and then your password used a special character they didn’t accept. We’ve moved from a simple 8 characters to requiring long complex passwords with special characters. We forget, passwords can be a pain. Just try to helping someone who doesn’t use computers create an account.
As always, the devil will be in the details.
Biting the hand that feeds IT
