3 ms·
Not proper as it only allows a single key.
by lysp 7y ago
Not proper as it only allows a single key.
- FabHK 7y agoYou could argue that it’s up to you to have a proper key backup strategy (ie not Google Authenticator). You don’t have several user names and passwords for one account, either.
- tialaramex 7y agoThe specification for WebAuthn (Security Keys) explicitly tells implementers they SHOULD support multiple tokens because otherwise the recovery scenario is terrible. You can't realistically "back up" cheap Security Keys, their whole design is predicated on your being unable to extract the secret inside them which makes them work.
- FabHK 7y agoThanks, I stand corrected.