4 ms·
Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device,
by Freak_NL 8y ago
Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device, or even by someone with direct access to the hardware (unless they actually disassemble the hardware with quite professional hardware).
Client-side certificates are a great technology, but you can copy the certificates without the owner knowing it. Getting the password is just a matter of social engineering or (further) compromising the device. It beats plain username plus password though!
- MrStonedOne 8y agoYou tout it as an upside that it can't be copied. But its really not. How to prepare for losing tokens is the major barrier to entry for 2fa, and it will be why it never sees mass adoption.
- baybal2 8y agoWell, that has been solved by smartcards for 2 decades already... More importantly, PKCS11 layer is completely independent of the browser internals, and works with just anything relying on common pk crypto: http, imap, smtp, sip...