4 ms·
> Cryptographic key never leaves your device Isn't that a huge usability issue? I use multiple devices, phone, laptop, desktop. How do you propose being able
by Osiris 9y ago
> Cryptographic key never leaves your device
Isn't that a huge usability issue? I use multiple devices, phone, laptop, desktop. How do you propose being able to log into the same website on more than one device if the key is on the original device?
Also, have you reviewed Web Authentication specification? It sounds very similar.
- Operyl 9y agoSo, that's kind of a weird half truth. The key is determined from your email + master key, and will always be the same as long as those two details are the same. The downside, and what I'm not a fan of, is neither can be changed without massive work. At least, that's what it seems like based on the README but it might be a little vague ...
- stephenr 9y ago> The downside What about offline generation of thousands/millions of combinations, for later attempts against SeucreLogin enabled sites. The password is something the user has to remember, so it's still not going to be particularly strong for the vast majority of people.
- homakov 9y ago> What about offline generation of thousands/millions of combinations Definitely not millions. It takes 20 seconds on a modern chip, it's memory hard scrypt so yeah, even few thousands are too expensive to crack.