4 ms·
webauthn has to solve the problem, or the problem will still exist and will stop mass adoption.
by MrStonedOne 8y ago
webauthn has to solve the problem, or the problem will still exist and will stop mass adoption.
- unimpressive 8y agoNot necessarily, it just has to not preclude a de facto standard solution. And it doesn't. The scheme described by OP above sounds fairly sane without compromising the overall security of the system (in the way that e.g, password reset forms and security questions do).
- MrStonedOne 8y agoNo, its a shitty way of doing it that will never work in practice. Nobody will remember where those are. They will likely download the pdf, store it in downloads, where it will be used by some Trojan to hijack their account, or they will lose it during a device switch or some dataloss event. Telling people to store one time codes securely and reliably, for every single account they own, and telling them that will only work for the services that bothered to add that on to their implantation of the standard, works for techys, but not the overall populous.
- ehsankia 8y agoHow is losing your key any different from losing your password? "Password" doesn't try to solve the problem of losing your password, that's beyond the scope. All recovery methods that apply to passwords also apply here.