4 ms·
Similar use case (2FA), but different implementation. Instead of typing in a code, you press a button. It also protects against phishing by validating the URL
by matharmin 8y ago
Similar use case (2FA), but different implementation.
Instead of typing in a code, you press a button. It also protects against phishing by validating the URL of the site you're authenticating on (with a code-based 2FA you can still enter your code on a phishing site, which then forwards it to the real one).
- scrrr 8y agoGood reasons, thanks!
- m_eiman 8y agoThere are apps that also validate the source and can automatically sign you in (or require a button press), e.g. https://www.kryptco.com https://www.kryptco.com Seems like it might be useful, but haven't had the time to try it out yet.
- tialaramex 8y agoAIUI Krypton is basically doing the same thing as these FIDO2 Security Keys, but their software substitutes an app on your Phone for the Security Key. So a web site offering WebAuthn can't tell the difference (unless you allow it to interrogate the "Security Key" to ask who made it, which you probably shouldn't) I personally would rather have Security Keys, but a solution like Krypton is definitely easier for a lot of users and obviously the price differential is hard to argue with.