> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
Replacing "something you know" with "something you have" is actually not an unalloyed good.
I don’t think they said that it was.
In that case how would you interpret the "we can just do better"?
> WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
Yes, because all of those teenage fanfiction readers are going to have yubikeys.
It’s built into most smartphones now isn’t it?
The same tech does Passkeys too. I suspect in the future we will move to passkey/yubikey only auth and store as little user data as possible.
And there will be a word you can type into a backup yubikey to make it an identical clone. I.e. a password.