You’re right, the math is slightly more complicated than rent v. mortgage payment.

Ben Felix, a popular financial YouTuber, made many a video about the math:

https://youtube.com/watch?v=j4H9LL7A-nQ https://youtube.com/watch?v=lBG-g1CKfgs

I don't think this is a useful comparison. This is Google's bug with Google's software vs. Project Zero's discoveries are (as I understand them) typically in software used by multiple people and thus there's a higher urgency to fix them.

Its not apples to apples but i think it shows Google's hypocrisy.

https://confs.tech/ has a decent crowd-sourced list

Even if your Master Password is “hunter3”, 1Password, as an example, will mix in a locally generated Secret Key to increase the entropy [1]

[1]: https://blog.1password.com/what-the-secret-key-does/

GitHub Pages also doesn’t (yet) support custom headers and you can add them with Cf via Workers. So if you’re concerned about the results of securityheaders.io, for example, you can add those in.

1Password's cloud offering architecture has a few important distinctions from other offerings. Namely the use of a password authenticated key exchange (PAKE) and a "Secret Key" that is never transmitted to 1Password servers. [1, 2] If you ultimately trust the app for local vaults, there's a case for extending that trust to the cloud offering.

[1]: https://blog.1password.com/what-the-secret-key-does/

[2]: https://old.reddit.com/r/1Password/comments/rp8t02/security_...

> Web3 is by far the easiest way to provide auth to a web app right now

Easiest by what measure? As I understand it, few browsers (read: only one or two) have built in wallets and outside of that the UX for this auth isn’t great. It’s hard to see how this is better/easier to use than existing OIDC/"Sign In With X" solutions.

Click “Connect” and sign into MetaMask wallet.

Agreed, it’s much the same as OIDC.

Tho personally, beyond GitHub for dev related sites, I won’t use them.

If anything it enables “websites” to be simpler, smaller.

A UI atop a single function.

Without the bloat. Without the “we must do enough to show value to get users to sign up”.

I just auth, use it, and move on with my life.

Sometimes there’s a fee per use. Sometimes that value is exchanged somewhere else in the transaction. But either way, I got what I needed and I’m done.

Don't forget that it can also be revoked without any action required from the application itself.

Web3 is everything we wanted out of auth for the last decade or so.

And what does this revocation accomplish? The app still has your unique address. This revocation is simply "don't log me in next time." You still need to use the app to delete any data, if that's even possible (highly-dependent on the app). This is no different than going to your GitHub account (in the parent comment's example and revoking https://docs.github.com/en/authentication/keeping-your-accou...).

I don't disagree that having a keypair on the client for authentication is a cool idea, but it's hardly specific to "Web3" (e.g. https://developer.apple.com/documentation/authenticationserv...).

Only if the web3 app itself is entirely decentralized, doesn't implement any moderation, and never votes to change the above. I suspect they will quickly need moderation, and therefore it wont matter if your identity is irrevocable as the platform itself could easily block it.

I do see the value in being able to bring an identity around and store it in a blockchain, but... extreme fragmentation is a bummer.

So we're just gonna forget OpenID exists?

Similarly, basically everyone using Ethereum just uses Infura nodes [1]. Web3 is no more decentralized than anything it purports to improve upon.

[1]: https://infura.io/

This is something that folks are working on via the `passwordrules` attribute https://github.com/whatwg/html/issues/3518

With that and a well-known endpoint for changing passwords (not quite the same thing as what you’re describing; https://w3c.github.io/webappsec-change-password-url/) we are moving in that direction.

Small plug for LavaMoat (https://github.com/LavaMoat/LavaMoat) which includes tools to more granularly disable dependency lifecycle scripts via @lavamoat/allow-scripts.