pricing (E-commerce) issues

Fake websites pretending to be legitimate websites in order to steal your passwords was considered a HUGE problem.

Fake websites pretending to be legitimate websites in order to steal your passwords was considered a HUGE problem. That's why TLS includes website certificates. The implementation is kind of a mess with commercial Certificate Authorities (CAs) being too expensive for small businesses to use, CAs getting hacked, or downright shady CAs that couldn't be trusted. A lot of websites didn't use TLS because of these problems. It took decades to get to the point we are at today where we have Let's Encrypt and all websites using TLS. Yet phishing still works because fake websites can use a URL that looks legit and they can get a certificate for that URL. We need to get away from shared secrets for authentication. Passkeys are fundamentally a way to do that, but they aren't perfect. Personally I wish TLS and Passkeys both were way less complicated. I think we could use asymmetric encryption for authentication without certificate authorities and secure enclaves and all that and still be more secure in general than we are today. Think ssh keys. But no browser or webserver does that. I think our best bet is probably to aggressively use passkeys and work (as was done with with TLS) to make them better until it mostly fades into the background like TLS has. The best solution I've found is yubikeys. I keep them on my keychain with my car's key fob. If I lose that key fob I don't know how I get my car started. It's not like the old days where you could pick the lock or get a few copies of the key made for cheap. Same with yubikeys. I worry about losing my yubikeys about as much as I worry about losing my car keys. A little, but not too much. I use both so often that it's not too hard to keep track of them.