3 ms·
Your laptop (probably) already supports FIDO2 with your TPM, now it's a matter of Google (and others) implementing it.
by StavrosK 5y ago
Your laptop (probably) already supports FIDO2 with your TPM, now it's a matter of Google (and others) implementing it.
- sam_lowry_ 5y agoThey have it already in WebAuthn in a completely siloed way. That is, they only implement hardware token support and if you want software tokens, they will make your life painful.
- md_ 5y agoDesktop (i.e. non-portable) WebAuthn authenticators are good for things like transactional authorization (e.g. confirm a payment on PayPal), but not especially useful for authentication: if you already have your WebAuthn secrets on your browser (or OS), you probably also have your authn cookies, too! I'm glossing over a few things (e.g. WebAuthn credentials can be stored in secure hardware, so can be more secure than cookies), but in general, WebAuthn secrets stored in a desktop TPM, while valuable in certain applications, aren't alone a very meaningful step toward getting rid of passwords—since passwords are primarily used for authenticating on new (never-before-used) endpoints. A slightly degenerate case is one where you use passwords to sign into your (say) MacBook, but Apple syncs the WebAuthn credentials via iCloud so you don't need a password on any other services. Which, like, if you're gonna do this—why not just use Apple's password manager and sync passwords? :)