Hacker News new | ask | show | jobs
by briHass 1087 days ago
The problem is how you get those keys, rather, the results of crypto functions on those keys, back to the requesting website. That process, 'Client to Authenticator'[1] relies on the goodwill of the 'Clients', which for all intents and purposes are: Chrome, Safari, Edge, Firefox, Windows 10+, iOS, and Android.

Maybe they'll always support cross-platform USB/NFC keys (they probably will), but I don't want an external device(s), especially if I have to remember to set up multiple devices for every site to have redundancy.

[1] https://fidoalliance.org/specifications/download/
1 comments
notatoad 1087 days ago
> The problem is how you get those keys, rather, the results of crypto functions on those keys, back to the requesting website

Yes. Good thing there's an open standard called webauthn, supported by all the major vendors, that defines an interoperable way to get the result of those crypto functions back to the websites that need them.

link
SgtBastard 1087 days ago
The person you're replying to is clearly talking about the portability of the private key material across multiple, heterogeneous clients - which webauthn doesn't touch.

Be better.

link