Username and password
The flow everyone knows, with the bill attached. Watch what the server stores here, then compare it with the passkey flow.
What this flow costs you
- A shared secret: both sides know something that grants access.
- A reset path, which is usually a weaker door than the front one.
- Reuse: the same secret across sites leaks sideways.
- A server-side list of hashes that is worth stealing, and worth cracking offline.