3 ms·

>In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, tra

>In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard. Ignoring site support, this exists. It's called USB and yubikey.

anotherhue 2y ago
Was called a SIM card before that.
- formerly_proven 2y ago
  Both are smartcards. Yubikeys also happen to support the USB HID CTAP protocol, which is something unprivileged applications can usually talk to directly on most operating systems. Most other CTAP transports are just smartcard transports (APDUs over PC/SC or NFC). Yubikeys also have a PIV applet, which isn't used for your typical enterprise X.509 PKI, and an OpenPGP applet, which typically isn't used.
- lxgr 2y ago
  PIV, GnuPG, or PKCS#15 are probably better comparisons. SIM cards use symmetric cryptography, which means you can only authenticate yourself to a single entity.
deleted 2y ago
[deleted]
JumpCrisscross 2y ago
> this exists. It's called USB and yubikey An extra physical device is a non-starter for mass adoption.
Too 2y ago
Having a big dongle sticking out of your iPhones lighning port is completely impractical, compared to using the integrated TPM backed storage, unlocked by face-id. Yes there are smaller dongles but only for usb-c and i still don't want to fiddle with it when charging. It's only a matter of time before desktops gain the same secure key storage as our phones do, add a hardware key to prove physical presence and then yubikeys are obsolete. The only future for yubikeys is for temporary transfer of keys under wrap between devices, where you don't want to use a cloud service for doing so. While an open api with replaceable internals is a nice idea and one that enabled yubikeys in the first place, once this is integrated in the SoC and the OS, there will be little need for alternative storage backends. What's more pressing now is pluggable synchronization of secrets, for those who don't want their choice of cloud provider to be bound to their choice of OS, or for those who rather synchronize entirely offline through a yubikey.

anotherhue 2y ago

Was called a SIM card before that.

formerly_proven 2y ago
Both are smartcards. Yubikeys also happen to support the USB HID CTAP protocol, which is something unprivileged applications can usually talk to directly on most operating systems. Most other CTAP transports are just smartcard transports (APDUs over PC/SC or NFC). Yubikeys also have a PIV applet, which isn't used for your typical enterprise X.509 PKI, and an OpenPGP applet, which typically isn't used.
lxgr 2y ago
PIV, GnuPG, or PKCS#15 are probably better comparisons. SIM cards use symmetric cryptography, which means you can only authenticate yourself to a single entity.

deleted 2y ago

[deleted]

JumpCrisscross 2y ago

> this exists. It's called USB and yubikey An extra physical device is a non-starter for mass adoption.

Too 2y ago

Having a big dongle sticking out of your iPhones lighning port is completely impractical, compared to using the integrated TPM backed storage, unlocked by face-id. Yes there are smaller dongles but only for usb-c and i still don't want to fiddle with it when charging. It's only a matter of time before desktops gain the same secure key storage as our phones do, add a hardware key to prove physical presence and then yubikeys are obsolete. The only future for yubikeys is for temporary transfer of keys under wrap between devices, where you don't want to use a cloud service for doing so. While an open api with replaceable internals is a nice idea and one that enabled yubikeys in the first place, once this is integrated in the SoC and the OS, there will be little need for alternative storage backends. What's more pressing now is pluggable synchronization of secrets, for those who don't want their choice of cloud provider to be bound to their choice of OS, or for those who rather synchronize entirely offline through a yubikey.