4 ms·

Hey look, client certs! The primary innovation here is browser buy-in, and API hooks for onboarding to make the UI/UX of the process suck less. This is a good

• tialaramex 9y ago
  Client certs always prove that niftich is niftich. This _might_ be fine, but most people aren't comfortable giving the same credentials to their bank, Facebook, and RedTube. This thing has a masking step, so you always prove to any particular site that you're the same person you were the last time you visited. But you don't (deliberately) present them with any clue as to who that is exactly. There's even a deliberate choice where though you can specifically identify models of product [ e.g. "This is a Mattel Barbie brand authenticator" so that in principle a bank could agree to use this standard but they only want to accept official bank-branded tokens ] the specification says DO NOT put unique serial numbers inside the tokens, if you want to distinguish them, make sure only large runs are distinguished e.g. "Batman authenticator" versus "Barbie authenticator" but never distinguish "Steve's authenticator" versus "Dave's authenticator" so as to preserve the privacy mechanism.
  • emlun 9y ago
    Just to be clear: The tokens _can_ contain unique serial numbers in some vendor-specific format - but they MUST NOT be in the attestation certificate, so the WebAuthn API will never expose them to the server.