News for hackers. Stuff that matters.

A comment on Getting Started with Security Keys. Parent comment

Re:Getting Started with Security Keys by jessaustin on Thursday October 31, 2019 @09:04AM (#21408243)
Sure it can handle logins to both "theircompany.com" and "service.theircompany.com", assuming the cert is set up correctly. It probably isn't going to figure out that those are related to "theircompany-service.net". This would arguably be a failure in domain setup, but I've certainly seen similar setups before.

Example: "https://hbweb.incompass-solutions.com/" uses the same credentials as "http://www.equineline.com/" since they're both owned by the Jockey Club.

[ Parent | on HN ]
Re:Getting Started with Security Keys by mceachen on Thursday October 31, 2019 @11:23PM (#21416036)
Some password managers (like bitwarden) allow for N URL patterns for a given credential, for exactly this purpose.
[ Parent | on HN ]
Re:Getting Started with Security Keys by jessaustin on Friday November 01, 2019 @12:29PM (#21420615)
Sure, but that's something the user sets up, so it still contradicts GP's contention that the user never needs to think about this. The only thing a password manager can (validly) do automatically is look at subject name and subject alt names. (I don't know that all of them even do this.) Even that's assuming that certs are set up correctly...
[ Parent | on HN ]