it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password

thats what I meant. I was referring to setting PasswordAuthentication to no in the sshd_config.

just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

You could use a different homeserver like tuwunel (a conduit fork), which is wayy easier to setup than the official one.

Interesting, the Cloudflare CAPTCHA works for me, but I’m on the Fairphone 5. I haven’t tried supertuxcart but minecraft (java) works pretty well. Youtube works for me too, but that might be because of missing hardware acceleration drivers on your phone.

I wouldn’t call PostmarketOS that niche. It’s a phone distro, but also runs on SBCs and allows installing the non mobile version of DEs