3 ms·

I'm not terribly familiar with U2F itself, but I assume the site has a way to identify you're using the right key that can be reused for this purpose?

• tialaramex 5y ago
  When you enroll a token with a site, the token mints a random new key pair and sends the site an ID and the public key, signed with the private key. The site records the ID and public key. When you return, to confirm it's really you, the site sends one or more IDs you've enrolled and says, sign this fresh random data with one of the associated private keys. Your tokens can look at the site and an ID and decide if they made that ID for that site, if they did they sign the message with the private key, proving you are still you. If they didn't make it, they pass and maybe you own a different token that can sign, or maybe you show them a different ID they do recognise. To reuse this capability for tracking, the site would need to guess who you are first. "I guess this is arsome, they have this U2F key". But if they can guess who you are, they already don't need such tracking.