Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Looks like they have had a section on key loss since at least webauthn 2[0], and explicitly rule out backing up keys. The suggested answer is "use multiple devices" which doesn't work great with platform authenticators (which are tied to a device). From the spec:

> This specification defines no protocol for backing up credential private keys, or for sharing them between authenticators. In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user. For example, a user might register platform credentials on frequently used client devices, and one or more roaming credentials for use as backup and with new or rarely used client devices.

So I guess you are right, it is on the vendors to handle backing up the keys from devices.

0: https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-m...



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: