Embed Notice

@whitequark @dalias @emma @mcc

- there are people who demonstrably cannot maintain continuity of access to a passkey vault; they require password-based access to services they use

- these people are often in desperate and vulnerable situations

- higher-security mechanisms like passkeys (and MFA) should *usually* not be mandatory, in part to accommodate such people

- in certain scenarios, where higher security is required, requiring them is reasonable, which means those people get excluded