Hacker News new | ask | show | jobs
by syntheticcdo 970 days ago
I ran into the issue earlier when implementing WebAuthn. Realizing that user authentication was tied to a single device/ecosystem, I wanted to allow the user to register a second key -- but because their authentication was tied only to their existing physical authenticator, I had no way to authenticate the second machine without magic email link, or setting a password and logging into the second device, which seems to completely defeat the purpose.