Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You are 100% correct that you need to add it to each service. This is a consequence of an intentional decision (keys cannot be duplicated). Streamlining it would definitely be an improvement.

That being said, it's not a problem in the real-world because FIDO is so sparsely supported. Hopefully PassKey speeds things along.



The relevant WebAuthn standard actually supports keys regardless of whether they can be duplicated. Even "virtual", software-only keys are supported. It's up to each individual service whether they allow the user to enroll such keys.


Streamlining would be an improvement, but it opens an attack vector.

Unfortunately, security and usability are always in balance.


I should have been more specific. Test how many clicks it takes to add a key to one of your "mainstream" accounts. We would hope that services which support FIDO eventually gravitate to a single UX language, that also reduces the time taken to register new keys.


Agreed


Could it be automated by a third-party service?

How much would you be willing to pay for such a service? ;)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: