3 ms·
I can think of a few ways to reduce that tracking risk. The token could use a per-site offset (securely derived from the per-site key) added to the global count
by cesarb 8y ago
I can think of a few ways to reduce that tracking risk. The token could use a per-site offset (securely derived from the per-site key) added to the global counter, and/or could have a set of global counters (using a secure hash of the per-site key to select one). I don't know how much that would increase the cost, or if there's something on the standard mandating a single global counter.
- crunchatized 8y agoNothing mandates it. In fact, it's specifically discouraged in the WebAuthn spec: > Authenticators may implement a global signature counter, i.e., on a per-authenticator basis, but this is less privacy-friendly for users. Since you can have multiple keys on the same site, you could go one better, and have a per-key offset. When the key is rederived from the one-time nonce sent from the server, you'd also derive a 16-bit number to add to the 32-bit global counter. But even that wouldn't actually be enough to make correlating them impossible. A large but finite set of independent global counters is a great idea, though. 256 32-bit integers is just 1 KiB of storage.