4 ms·

I hope it catches on! Though they suggest storing the signing keys in TPM which is ideal, even storing them locally in the browser in an unextractable manner wo

I hope it catches on! Though they suggest storing the signing keys in TPM which is ideal, even storing them locally in the browser in an unextractable manner would be enough to prevent session hijacking.

grim_io 1y ago
One man's session hijacking is another man's unofficial third party client support.
Retr0id 1y ago
"unextractable" from the perspective of the JS-facing APIs does not necessarily mean unextractable by local malware (unless it's backed by something like a TPM!)
- odie5533 1y ago
  Most session hijacking is via JavaScript, so even malware-extractable browser-TPM would help a lot!
  - Retr0id 1y ago
    You can use js-nonextractable keys for auth today, no new specs needed.