3 ms·

Persona was just some Mozilla experiment. But WebAuthn is alive and well, as far as I know.

• hombre_fatal 7y ago
  Webauthn was weirdly impractical when I looked at it. For example, the private key gets stored in hardware protection thus cannot be exported. So the UX is a non-starter if the user wants to log in from more than one device. People will say that's a feature. But it's also why it's never going to replace passwords.
  • rene_kapusta 7y ago
    You can register multiple hardware tokens for a service (if the site supports that). Regarding export of private keys -- some crypto hardware wallets also support the FIDO[2] specs. -- so there you have the option to use the 12 words to setup a new hardware with the same private keys ...
  • convolvatron 7y ago
    this really isn't the best thread to ask, but I've been quite curious if there are any other, less secure, key stores under consideration (i.e a filesystem or remote sso service) under CTAP?
  • tialaramex 7y ago
    In a typical WebAuthn scenario the Private Key is actually being stored by the Relying Party, they just don't know that because it's encrypted with a symmetric key. That symmetric key is baked inside the hardware token. Yes I'll say not being able to get that symmetric key out of the hardware token is a feature, because it is. Without that feature you'll have to educate users about how to care for their symmetric key and every time you inevitably fail they get exploited.