3 ms·
You don't tie it to a single device. For consumers: it's considered good form for these services to allow multiple webauthn devices tied to an account. So you
by monocasa 4y ago
You don't tie it to a single device.
For consumers: it's considered good form for these services to allow multiple webauthn devices tied to an account. So you keep a yubikey somewhere to get back in, on the off chance that you simultaneously lose access to your phone and your computer.
For corporate accounts: an admin provisions a new device for you and gives it to you.
- account-5 4y agoOk that's fine but that assumes the consumer is going to have more than one device, and has the wherewithal to authenticate to the same service from multiple devices. Since this technology is in a large part a response to consumers utilising passwords badly I don't see this as a valid assumption. Let's ignore that some consumers won't have their own devices and therefore won't be able to use any service with this in place. I know people who do online banking at the library because they have no choice. My current set up with my password manager offers way more flexibility. And the only downside it that the password gets transmitted, encrypted, but it leaves my device.
- signal11 4y agoI’m really interested in 1Password’s approach to WebAuthN[1]. If they can deliver on their cross-platform promise, other projects will likely be able to do so too. [1] https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/
- account-5 4y agoI'm definitely all for passkeys (public/private key cryptography) as a replacement for passwords. But like passwords it needs to be in my control, cross platform and device, and not relying on some multinational targeted advertising cooperation's goodwill. Hopefully keepass[xc] role out support too.
- gnufx 4y agoFor "corporate" accounts, isn't PIV better, since it works with more than web (like Kerberos without contortions) and lives on your id card fairly readily?
- deleted 4y ago[deleted]