4 ms·
Seems it's like ssh keys, but fiddled automatically in the browser. A password unlocks the local keys. This means keys need to be transported between devices.
by yobbo 4y ago
Seems it's like ssh keys, but fiddled automatically in the browser. A password unlocks the local keys.
This means keys need to be transported between devices. Which means even tighter coupling to google and microsoft accounts.
- throwaway92394 4y agoOr apple's iCloud (see their passkey thing also currently on the front page) EDIT: Yes you don't need to use a syncing service. But it will be important for it to be portable between syncing services, as that is what most consumers will be using.
- yakak 4y ago> This means keys need to be transported between devices Pure keys are on tokens that support Bluetooth/NFC/USB to talk to whatever devices you want. One can use a built in key on a device with a security enclave which means using one device to auth addition of another, but you might do that with alerts to authorize, etc. Anyone who doesn't have a powned problem is using something like TOTP auth codes which has all of the downside of Fido and none of the convenience.
- cowtools 4y agoYou couldn't just emulate the secure enclave?
- yakak 4y agoYou can, just like you can store your TOTP key in your password manager to have the security of 1FA again. A site that doesn't want you to could try to use attestation certificates to force you to use a real vendor's keys which should never be extractable.