News for hackers. Stuff that matters.

A comment on Web Authentication: Proposed API for accessing Public Key Credentials. Parent comment

Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @05:22PM (#16805580)
I was thinking about soft U2F tokens and came to the conclusion that they wouldn't be that much different from a cookie that just always bypassed the second factor for that specific browser. Of course, it could be stolen from the browser, but so could the U2F key.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by emilecantin on Tuesday April 10, 2018 @07:14PM (#16806514)
The browser never sees the key with U2F; everything is computed on the USB device.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @07:20PM (#16806574)
I'm talking about soft U2F tokens, i.e. software-based.
[ Parent | on HN ]