4 ms·
The problem is how you get those keys, rather, the results of crypto functions on those keys, back to the requesting website. That process, 'Client to Authentic
by briHass 3y ago
The problem is how you get those keys, rather, the results of crypto functions on those keys, back to the requesting website. That process, 'Client to Authenticator'[1] relies on the goodwill of the 'Clients', which for all intents and purposes are: Chrome, Safari, Edge, Firefox, Windows 10+, iOS, and Android.
Maybe they'll always support cross-platform USB/NFC keys (they probably will), but I don't want an external device(s), especially if I have to remember to set up multiple devices for every site to have redundancy.
[1] https://fidoalliance.org/specifications/download/ https://fidoalliance.org/specifications/download/
- deleted 3y ago[deleted]
- notatoad 3y ago> The problem is how you get those keys, rather, the results of crypto functions on those keys, back to the requesting website Yes. Good thing there's an open standard called webauthn, supported by all the major vendors, that defines an interoperable way to get the result of those crypto functions back to the websites that need them.
- SgtBastard 3y agoThe person you're replying to is clearly talking about the portability of the private key material across multiple, heterogeneous clients - which webauthn doesn't touch. Be better.