> This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper.
This is precisely why user should run away. Service provider is moving liability to end user and washing their hand away, while user gets screwed if anything happens during vacation.
End user also gets screwed when they are phished for their paper key. And I'm not sure about liability, unless you consider the requirement to check haveibeenpwned once a week for a breach to be no one's responsibility.
This is precisely why user should run away. Service provider is moving liability to end user and washing their hand away, while user gets screwed if anything happens during vacation.