4 ms·
But then of course you also lose one of the main security properties that made webauthn desirable in the first place. If you can copy the credentials to your o
by bigfatkitten 2y ago
But then of course you also lose one of the main security properties that made webauthn desirable in the first place.
If you can copy the credentials to your own new device, an adversary can copy them to their device also.
- wongarsu 2y agoThat's true of SMS 2FA too, though, as well as many TOTP implementations. Being able to copy credentials to a new device is a major usability plus, consequently it is widely implemented. Physical webauthn tokens are obviously better, but software webauthn is the second best thing. Software TOTP is a good bit worse, and SMS OTP shouldn't even qualify as a secure method
- lxgr 2y agoDefinitely, so for scenarios where I want the strongest possible 2FA, I use a hardware authenticator. For everything else, WebAuthN based on a software authenticator is both more secure and more convenient than passwords, and realistically even than TOTP (having a higher takeover risk but lower phishing risk).
- kemotep 2y agoYou can say the same thing about ssh keys.