> the device might be using a different counter for Facebook and GitHub. At least for YubiKey, it appears to use a global counter: https://developers.yubico.c

> the device might be using a different counter for Facebook and GitHub. At least for YubiKey, it appears to use a global counter: https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener... > There is a global use counter which gets incremented upon each authentication, and this is the only state of the YubiKey that gets modified in this step. This counter is shared between credentials. Having a global counter does seem like it could weaken the ability to detect cloned keys. If an attacker could clone the key and know the usage pattern (e.g., there are usually 100 uses of non-Facebook services between uses of the Facebook service), then they might be able to use it for a while without being detected. Though, having service-specific counters may have worse security ramifications (e.g., storing which services the key has been used with). Though if an attacker is going to that much trouble, they may as well just use the wrench-to-the-head method.