4 ms·
A backup key could have ability to reject original one, problem solved...
by sheerun 4y ago
A backup key could have ability to reject original one, problem solved...
- lxgr 4y agoHow would that work in practice? Key/certificate revocation is notoriously hard.
- withinboredom 4y agoWith GitHub, you just remove it from your account. For 2fa, same story.
- sdfgdfgbsdfg 4y agoHere's how YubiCo proposes to address this: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco... Revocation is done RP side, but it essentially allows a primary authenticator to register itself and the secondary on a given RP