3 ms·
> If forced, I will find a password manager that provides a simulated WebAuthn device. I don't think this is a workaround as much as it will be the default use
by klabb3 4y ago
> If forced, I will find a password manager that provides a simulated WebAuthn device.
I don't think this is a workaround as much as it will be the default use case. Password managers are in a perfect position to keep custody of your private keys across devices, which provides acceptable security for the average person.
Even the password-less-ness of it is not actually entirely free from passwords. Both your iPhone cold booting and your password manager will require a master passphrase/password/pin to unlock your vault (and then use pin/face id for subsequent auth). The difference against a regular pw is that an attacker can replay an intercepted password for session renewal but a public key challenge cannot be replayed. It also means that you need a pw manager integrated all the way into the app/browser, and can't copy paste passwords. This is probably the biggest challenge.