4 ms·
No? Your private keys are still on your physical device which you own. The providers do not get your key material. If your threat model includes “the manufactu
by stouset 4y ago
No? Your private keys are still on your physical device which you own. The providers do not get your key material.
If your threat model includes “the manufacturer of the device I use to authenticate myself is actively working against me”, you are already completely lost.
- xyzzy123 4y agoIn order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... and multi-device passkeys. Your keys may never leave secure storage (tho again that is an implementation detail), but how sure are you about the sync implementation or the backend configuration that dictates which keys or methods are acceptable authenticators? As a trivial example, it seems very likely that providers will implement one or more forms of backdoor to ensure that LEOs can access your cloud resources.