3 ms·

"unextractable" from the perspective of the JS-facing APIs does not necessarily mean unextractable by local malware (unless it's backed by something like a TPM!

"unextractable" from the perspective of the JS-facing APIs does not necessarily mean unextractable by local malware (unless it's backed by something like a TPM!)

odie5533 1y ago
Most session hijacking is via JavaScript, so even malware-extractable browser-TPM would help a lot!
- Retr0id 1y ago
  You can use js-nonextractable keys for auth today, no new specs needed.