4 ms·

Ah interesting! Thats cool :) Aside from the FIDO transaction itself (which from your description sounds not to shabby) would you say then that passwords and FI

Ah interesting! Thats cool :) Aside from the FIDO transaction itself (which from your description sounds not to shabby) would you say then that passwords and FIDO are equivalent in terms of exposure of personal information? I guess I figured the location aspect seemed like a differentiating factor.

ecesena 4y ago
FIDO is strictly better: with “password” you share your email + password with the server. If you use the same password on another site, the server knows your password. You may trust the server, but in case of a leak you’re doomed. With FIDO you share email + a signature that doesn’t reveal anything at all. Privacy aside, the FIDO signature also protects you against phishing as the (hostname of the) url that’s displayed in the browser is part of what it’s signed, so an attacker can’t reuse the signature to log you on a different domain — unlike the password (and other 2FA like otp codes) that can be phished.