3 ms·
That's not really how they're meant to be used. Want multiple keys? Register multiple devices. Copying the same key around willy nilly just means you can't revo
by RL_Quine 4y ago
That's not really how they're meant to be used. Want multiple keys? Register multiple devices. Copying the same key around willy nilly just means you can't revoke access selectively. Not being able to export keys and mishandle them is kind of a design goal rather than a limitation.
- exmadscientist 4y agoThat's because WebAuthn in general is a poor match to most lower-stakes uses of passwords. Not everything is a bank account. Many things are appropriately authenticated using "just" a password manager. WebAuthn refuses to acknowledge that, because it's a standard born of corporate security officers serving their own ends. It's still appropriate for some things an average human or techie human does, but not everything, and its promoters need to stop acting like it is the only game in town.
- iggldiggl 4y agoSo every time I sign up somewhere I need to dig out all devices (including possible off-site backups if I was really thorough?) and sign them all up, too? If yes, then that doesn't sound particularly enticing…