4 ms·
it's a shame webauthn didn't permit a way of registering a token not in your physical possession I don't want to have to drive to my parents/bank safety deposi
by blibble 3y ago
it's a shame webauthn didn't permit a way of registering a token not in your physical possession
I don't want to have to drive to my parents/bank safety deposit box each time I register on a new website
(and allowing the private key to be exported and shared defeats the point entirely)
- Mindless2112 3y agoAside from your email account and maybe a few other critical accounts, you should probably just not bother. If you lose your passkey there should be a "lost passkey" flow just like there has been for a forgotten password.
- anotherhue 3y agoEveryone knows there's no way to encrypt with one key and decrypt with another.
- goalieca 3y agoEach website should have a unique signing key. This is how you prevent one site from logging into another since the login is now just a signed challenge.
- postalrat 3y agoDoes anything get stored on the device when you register on a site? As far as I know it does not.
- goalieca 3y ago> YubiKeys can store a maximum of 25 passkeys. We are evaluating increasing this in the future because of the likely increase in fully passwordless experiences across the web that require them.
- jiveturkey 3y agoThis is up to the authenticator and is completely possible.