Seriously, why the hell are we still using username/password when browsers have supported requesting client certificates for years now.
Literally just learned today that it's an API that's supported in all the major browsers already. Maybe because it's at the TLS/Server-side layer instead of inside client-side JS or the HTTP layer?
Only downside is now I need to add this functionality to Agregore. :P
Answer: Because OS vendors did not want to make certs & keys first-class objects that are highly visible to users (and manageable by them).
TBH, I'm not sure if that would be better or worse than using password managers.
@tasket I think one thing that is different from password managers in this scenario is that you can use your key instead of an email+password combo and could potentially reuse credentials more easily. also has an obvious path for hardware keys
