That is true, but let's also not forget that the bug title is "HTTP basic auth credentials prompt should make the origin stand out more" and nothing has been done about this in the last 7 years. Instead of making it stand out that the text is coming from the server, they just removed it completely. I found the original prompt to be pretty clear already ("the server asks for a username and password, it says: ...") but I'm sure in all these years they could have brought it back and made it more obvious that it's not Chrome asking for these things.
That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.
Comments
That is true, but let's also not forget that the bug title is "HTTP basic auth credentials prompt should make the origin stand out more" and nothing has been done about this in the last 7 years. Instead of making it stand out that the text is coming from the server, they just removed it completely. I found the original prompt to be pretty clear already ("the server asks for a username and password, it says: ...") but I'm sure in all these years they could have brought it back and made it more obvious that it's not Chrome asking for these things.
It is because the only "native" login they want you doing is to their sync services.
That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.