3 ms·

> just seem less good than client certificatest and certificates in HSMs That's effectively what FIDO/U2F are.

• tialaramex 5y ago
  Most importantly FIDO isn't identity. It's deliberately only authentication. Facebook and GitHub both have records that allow them to authenticate that I'm still me, using FIDO Security Keys, but if they compare records they intentionally do not learn that they're authenticating the same person, even though that is in fact what they're doing. The place you'd logically put an "identifier" (and in fact it's even called ID) in protocols like WebAuthn is chosen effectively at random for each enrolment. On your phone the ID is actually just a bunch of random bits, on a cheap Security Key it's much more complicated but the effect for relying parties is that it's random.
  • jfrunyon 5y ago
    While that's true, I would argue that makes it more good than certs on an HSM, not less good as the person I replied to posited.