Everyone gangsta until they realize security for the sake of security isn't a thing, but that it should strike a good balance between purpose and convenience
May I introduce you to the german "Elster" tax portal?
Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. Their linux program is a 10MB shell script that crashed my text editor.
They have a probably encrypted keyfile but that expires in 3 years and you need to
- login
- switch to desktop mode as otherwise they hide it
- send a code per email
- the site generated another code you also need
- you get another email with another link, which also doesnt include any code in the URL
- you need to log out to login again?
- you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out, the other from the email
- then wait forever to create the keyfile
- you also need to setup a new password for the keyfile
So afaik you need a username, email, password, keyfile and password for the keyfile.
- why a keyfile again?
- why a username if it is never used?
- why so many emails with all the secret credentials instead of secure e2ee login on the website?
This should be illegal