Apple, Google, and Microsoft commit to expanded support for FIDO standard
Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, convoluted, and hopelessly tied to proprietary stuff you can only get from these big corporations. Interoperability is almost guaranteed to not be a thing.<p>Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms.<p>That's why people still use simple email/password as a way to authenticate. It's just too much of a pain to implement anything else for independent web developers. Take fido/webauthn for example, which FIDO standardized and which then got restandardized/reimagined by the W3C as webauthn. That stuff was delivered years ago in a half-assed way. Pretty much the only widely used thing in this space is yubikey. The only people I know that actually use that or know about it are developers.<p>Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? What's the holdup? Do they lack the imagination or is there another reason that perfectly sane proposals from engineers they employ to do something like that consistently get shot down by management? Which is probably exactly what happened. Over and over again.<p>They fundamentally don't like security standards that reduce their grip on user identity and "owning" that.