News for hackers. Stuff that matters.

A comment on RIP, Passwords. Here’s What’s Coming Next. Parent comment

Re:RIP, Passwords. Here’s What’s Coming Next by donmcronald on Thursday January 19, 2023 @02:17PM (#34444356)
> WebAuthn works by users having a separate private key for each site

Really? I always thought it was a single key. How does that work without having devices run out of storage?

[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by saool on Thursday January 19, 2023 @03:54PM (#34445476)
In the typical case and handwaving a bit:

On registration, the server is handed a site/user-specific key pair _encrypted_ with the master key of the authenticator device (your usb key or your phone, etc), together with the plain-text site/user-specific public key.

On authentication, the server sends down that encrypted blurb, which is temporarily decrypted and then used to sign a challenge the server sent.

So basically the server is used as storage. There are exceptions to this (e.g. resident/discoverable credentials on hardware keys)

[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by PassageNick on Friday January 20, 2023 @11:40AM (#34455641)
No -- every origin has it's own Public/Private key that is stored on the TPM chip on your device. The TPM is designed specifically for securing these keys.

Each passkey is a modest amount of data, and I don't see a person having so many passkeys that the TPM gets full.

[ Parent | on HN ]