4 ms·

I, personally, will not be using WebAuthn by choice. I have a password manager that provides similar benefits, with universal compatibility. If forced, I will f

• klabb3 4y ago
  > If forced, I will find a password manager that provides a simulated WebAuthn device. I don't think this is a workaround as much as it will be the default use case. Password managers are in a perfect position to keep custody of your private keys across devices, which provides acceptable security for the average person. Even the password-less-ness of it is not actually entirely free from passwords. Both your iPhone cold booting and your password manager will require a master passphrase/password/pin to unlock your vault (and then use pin/face id for subsequent auth). The difference against a regular pw is that an attacker can replay an intercepted password for session renewal but a public key challenge cannot be replayed. It also means that you need a pw manager integrated all the way into the app/browser, and can't copy paste passwords. This is probably the biggest challenge.