3 ms·

Also, diversity means you trust all of the providers; from a security perspective it's worse.

• stouset 3y ago
  No? Your private keys are still on your physical device which you own. The providers do not get your key material. If your threat model includes “the manufacturer of the device I use to authenticate myself is actively working against me”, you are already completely lost.
  • xyzzy123 3y ago
    In order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... and multi-device passkeys. Your keys may never leave secure storage (tho again that is an implementation detail), but how sure are you about the sync implementation or the backend configuration that dictates which keys or methods are acceptable authenticators? As a trivial example, it seems very likely that providers will implement one or more forms of backdoor to ensure that LEOs can access your cloud resources.