2 ms·
You can use multiple usernames. As for privacy, services can require additional info from your key (WebAuthn shows an additional confirmation button). This inf
by dandanua 4y ago
You can use multiple usernames.
As for privacy, services can require additional info from your key (WebAuthn shows an additional confirmation button). This info includes the manufacturer and probably some other info (not sure about that). Otherwise it should be impossible to tell if a single key is used for multiple usernames.
- sebk 4y agoAttestation information requires that at least 100k security devices share the same attestation key, so device information can't really be used to track a given user. The proposed devicePubKey extension that helps RPs reason about which device is authenticating with a given Passkey scenario also requires domain-specific DPKs, meaning multiple identities using the same authenticator are indistinguishable as far as WebAuthn is concerned. Of course, other signals like origin IP or browser fingerprinting can be used to correlate identities.