Re:Turn on MFA Before Crooks Do It for You
by tialaramex on Saturday June 20, 2020 @01:51AM
(#23582031)
They don't, but that's a non-compliance. The WebAuthn (WebAuthn is the standard way to support FIDO in a browser) specification explicitly tells Relying Parties (which is what AWS are here) that they need to allow users to enrol more than one key.
The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already.
The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.
The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already.
The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.