4 ms·
It's a feature, not a bug, but in order for it to be a feature, every service should accept multiple FIDO2 keys. Many services get this utterly wrong, including
by dheera 5y ago
It's a feature, not a bug, but in order for it to be a feature, every service should accept multiple FIDO2 keys. Many services get this utterly wrong, including AWS, while Google, Github, and Facebook notably have good implementations.
Why it's a feature: if you lose a key you can log in with another key and disable the lost key.
If you lose your house key you have no option but to change the lock, if you want to be safe from thieves.
- eikenberry 5y agoThat feature will kill the standard outside of mandated (corporate/gov) use cases. There's no way I want to have to worry about registering 2-3 FIDO2 keys with every site I currently use passwords for. And there's no way I'd trust Google's (or any other company) OAuth to be my master login for every site.. assuming they all take OAuth and that Google accepted multiple FIDO2 keys. IMO it's a mis-feature and will keep it from eliminating passwords. In fact I think it will only reinforce password use as the one good case for it is to lock your password manager.