That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.
Comments
It is because the only "native" login they want you doing is to their sync services.
That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.