3 ms·
It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-securit
by AlexandrB 3y ago
It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/ https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...
- orbisvicis 3y agoWhy couldn't a non-resident security key send it's public key as username? And the response contains the actual username and private key.
- Repulsion9513 3y agoPrivacy. The idea, IIRC, was to have separate identifying material for each site.
- crote 3y agoBecause the security key doesn't store any public keys. Basically, the security key stores a single symmetric key. It'll generate a public/private keypair on registration, encrypt it, and send it to the server. On authentication the server will return the keypair back to the security key, which decrypts it and uses the retrieved private key for authentication.