3 ms·
With hardware U2F the benefit lies in not having the private key available on the client device at all. That means that copying it is impossible (without disman
by Freak_NL 9y ago
With hardware U2F the benefit lies in not having the private key available on the client device at all. That means that copying it is impossible (without dismantling the key and using quite advanced equipment to attempt to read the private key).
With software U2F I think you are right; client-side certs just work, now, in all major browsers. Installing them is a hassle, but it can be managed with good documentation (we use client-side certificates for authentication at the moment).
Personally, I don't think software U2F should exist outside of development and testing scenarios.
- hdhzy 9y agoWell you can have client certificate on hardware. Some hardware even has attestation built in [0] so you can be sure that the private key is non exportable. PIV based smartcards do not require external drivers on most modern OSes. [0]: https://developers.yubico.com/PIV/Introduction/PIV_attestation.html https://developers.yubico.com/PIV/Introduction/PIV_attestati... U2F is designed for only one algorithm and allows a lot of optimizations (e.g the private keys are not really stored on the device but rather generated from master seed and origin). That's why they are substantially cheaper than PIV devices.