Re:Payment Request API
by tialaramex on Monday March 02, 2020 @09:34PM
(#22471308)
In a typical WebAuthn scenario the Private Key is actually being stored by the Relying Party, they just don't know that because it's encrypted with a symmetric key. That symmetric key is baked inside the hardware token.
Yes I'll say not being able to get that symmetric key out of the hardware token is a feature, because it is. Without that feature you'll have to educate users about how to care for their symmetric key and every time you inevitably fail they get exploited.
Re:Payment Request API
by rene_kapusta on Monday March 02, 2020 @04:02PM
(#22468940)
You can register multiple hardware tokens for a service (if the site supports that).
Regarding export of private keys -- some crypto hardware wallets also support the FIDO[2] specs. -- so there you have the option to use the 12 words to setup a new hardware with the same private keys ...
Re:Payment Request API
by convolvatron on Monday March 02, 2020 @07:26PM
(#22470621)
this really isn't the best thread to ask, but I've been quite curious if there are any other, less secure, key stores under consideration (i.e a filesystem or remote sso service) under CTAP?
For example, the private key gets stored in hardware protection thus cannot be exported. So the UX is a non-starter if the user wants to log in from more than one device.
People will say that's a feature. But it's also why it's never going to replace passwords.