3 ms·
Why do you need qr codes if a user account can be associated with multiple webauthn credentials on the server side? Surely a user can log in with any device the
by grey-area 4y ago
Why do you need qr codes if a user account can be associated with multiple webauthn credentials on the server side? Surely a user can log in with any device then?
- jsmith45 4y agoHow do you securely register a second phone/computer? You should ideally be signed into the site on that second phone/computer to register it, which is what the QR code helps with. Once signed in, you can then securely register a key from the platform authenticator of the second computer. After all the idea of passwordless authentication is to not even have any password as a fallback. If you do have a password based fallback, then obviously you can use it to sign in to register the new device, but since WebAuthn is far more secure than a password, the preference is to not have such a fallback. And of course, an account recovery flow based on emails or SMS and possibly "security questions" are almost worse than a password. The QR code is far more convenient than needing to buy a fido2 security dongle, especially one that supports USB-A (for most desktops/laptops), USB-C (for android/iPad/other laptops), and lightning (for iPhone), so you can register it via any already registered device, and then use it on any other device for initial sign-in.
- grey-area 4y agoYou apply with the untrusted one, sign in with the trusted device then approve the untrusted one. Same way as you add another fingerprint to a device for example by providing an already trusted identity.