Interesting to see a hacker news expert coming up with something with some good buzzwords - two factor and public-key crypto. That said, I like the apple appro

Interesting to see a hacker news expert coming up with something with some good buzzwords - two factor and public-key crypto. That said, I like the apple approach better here. No forward secrecy? Passing private keys all over the place? Look at how apple does it. Private keys stay on device in secure enclave, even user cannot export from there. I don't even think system root (which user and software generally don't have access to) can export private keys. Adding a new device to the account involves old device generating a funny looking wave pattern which new device scans. This has always worked fine for me. I assume apple then adds public key of new device to my acct.