Comment Unloseable passwords (Score 2) 71
Facial Recognition is a problem because one's face is always there and can be photographed for later break-ins to any secured device. It stops opportunistic thieves, not a planned robbery. Similarly, PassKeys are really passwords the user never touches: This makes the phone the point of weakness, as there's no access when the phone is missing, and whoever has the phone has control of the account. There is a protocol for moving PassKeys to a new phone (CXF, CXP) but only Apple supports it.
Schools, supposedly have taught computer literacy for 15 years but password management still seems to be a blind-spot. SOHOs still don't record their product keys and passwords (since one needs an online account to download the software). As, explained above, I do not see the password-one-can't-lose philosophy as good security.
On the plus side, the government services I use, have quietly offered OTP, and it uses SHA256, not the SHA1 mandated by Google and Microsoft. The "otpauth://" URL contains a "&algorithm=sha256" parameter.